Analysis
- max time kernel
151s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
20/01/2022, 07:31
Static task
static1
Behavioral task
behavioral1
Sample
proforma fatura.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
proforma fatura.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target proforma fatura.exe
- Size 1002KB
- Sample220120-jcdj6aggd5
- SHA256 bed2b6abf700b607d4f856c63832bae23f4120a8786b5af4cbdaa0d8525a47bc
- MD5 fb55802ac8a807177bd16cf4e3322d1b
- SHA1 36514cb2b383e907fef665d1b4cbc4613ea8b570
- SHA512 440df5bbc9c98ef451ad23252c8283eb81af5c0ff8a6b55da0a865076cfaa729a3921933084c22eb97a60c628e0453cbd64c8072e5317f34402cd7b43dd6c5fe
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
ariv
Decoy
-
validationlinkedterms.xyz
-
essentialpraxis.com
-
kjbservicesmn.com
-
wikiofgames.com
-
familiapena2475.com
-
xn--yckc3am9f2et438ajmxc.xyz
-
fluxmmaoffers.com
-
absampee43.com
-
videofx.store
-
metropolitanprofitness.com
-
fc8fla8kzq.com
-
espotplay.com
-
ammarus.com
-
tangerineharbor.com
-
esvengineers.com
-
bullfrogoutdoors.com
-
beefdiets.quest
-
958kk.com
-
triptoursportsaid.com
-
vestontalons.com
-
macallanwhiskysuppliers.com
-
documentrus.com
-
suddennnnnnnnnnnn36.xyz
-
68127.online
-
fombge.com
-
tigatek-ev.com
-
absender.digital
-
remote-soc.com
-
allfivestarnails.com
-
opurtnsdqr.icu
-
druvajtteet.quest
-
cplbet168.xyz
-
tomrose.net
-
official-dyson.online
-
downlownft.com
-
bettingsoftwareshop.com
-
in-cranium.com
-
nouvec.com
-
timberwolfcanada.com
-
theprosperityrevolution.com
-
yourfamilylook.com
-
comidie.com
-
mytechmadesimple.com
-
builtbyfable.com
-
arsebangers.com
-
drbnkrs.com
-
allcoasttowingfl.com
-
old038359222.com
-
abodhakujena.com
-
newearthhg.com
-
letyoursoulcontrol.com
-
insight-j.com
-
adfslab.cloud
-
glowiebyher.com
-
weixiaotuo.com
-
fltsavionics.com
-
stuiversuitvaart.com
-
csrrealestatemx.com
-
hairbeauty-city.com
-
calwim.com
-
linwuyayz.com
-
interstate-ts.com
-
mien-atelier.com
-
neatbourbonpodcast.com
-
my163111.com
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader First Stage 1 IoCs
resource yara_rule behavioral2/memory/680-182-0x0000000002DB0000-0x0000000004CFA000-memory.dmp modiloader_stage1 - ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/3780-177-0x00000000039D0000-0x0000000003A47000-memory.dmp modiloader_stage2 - Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/3780-179-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral2/memory/1648-186-0x0000000000540000-0x0000000000569000-memory.dmp xloader - Sets service image path in registry 2 TTPs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WD8XVP98M = "C:\\Program Files (x86)\\Mtdt\\pz7fl0l-.exe" WWAHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jujhzcfdpx = "C:\\Users\\Admin\\Contacts\\xpdfczhjuJ.url" proforma fatura.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run WWAHost.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 680 set thread context of 2496 680 logagent.exe 14 PID 1648 set thread context of 2496 1648 WWAHost.exe 14 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mtdt\pz7fl0l-.exe WWAHost.exe -
description ioc Process Key created \Registry\User\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 WWAHost.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 680 logagent.exe 680 logagent.exe 680 logagent.exe 680 logagent.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe 1648 WWAHost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2496 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 680 logagent.exe 680 logagent.exe 680 logagent.exe 1648 WWAHost.exe 1648 WWAHost.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 680 logagent.exe Token: SeDebugPrivilege 1648 WWAHost.exe Token: SeShutdownPrivilege 2496 Explorer.EXE Token: SeCreatePagefilePrivilege 2496 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3780 wrote to memory of 680 3780 proforma fatura.exe 56 PID 3780 wrote to memory of 680 3780 proforma fatura.exe 56 PID 3780 wrote to memory of 680 3780 proforma fatura.exe 56 PID 3780 wrote to memory of 680 3780 proforma fatura.exe 56 PID 3780 wrote to memory of 680 3780 proforma fatura.exe 56 PID 3780 wrote to memory of 680 3780 proforma fatura.exe 56 PID 2496 wrote to memory of 1648 2496 Explorer.EXE 57 PID 2496 wrote to memory of 1648 2496 Explorer.EXE 57 PID 2496 wrote to memory of 1648 2496 Explorer.EXE 57 PID 1648 wrote to memory of 2076 1648 WWAHost.exe 59 PID 1648 wrote to memory of 2076 1648 WWAHost.exe 59 PID 1648 wrote to memory of 2076 1648 WWAHost.exe 59 PID 1648 wrote to memory of 2808 1648 WWAHost.exe 64 PID 1648 wrote to memory of 2808 1648 WWAHost.exe 64 PID 1648 wrote to memory of 2808 1648 WWAHost.exe 64
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\proforma fatura.exe"C:\Users\Admin\AppData\Local\Temp\proforma fatura.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:680
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵PID:2076
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:2808
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 0829f954728be43a5a8fa1a25fc7aa8c nHwbbKrc90q5AA2t+qJTRQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3868