Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 09:37
Static task
static1
Behavioral task
behavioral1
Sample
626e958b355520e458a5a04ef1b3eade.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
626e958b355520e458a5a04ef1b3eade.exe
Resource
win10-en-20211208
General
-
Target
626e958b355520e458a5a04ef1b3eade.exe
-
Size
779KB
-
MD5
626e958b355520e458a5a04ef1b3eade
-
SHA1
4feb6d823b5370e509907b4cdfd8d0922d96ac11
-
SHA256
74f9f40a7808dde465c27d303835332b0d12509403d32d4a1f45ac5aaf790ff5
-
SHA512
ddda9307f420b77390cb5a3bfea9c96cdb5bb0c2daae439805770825de566a63b9141e7aa4f83a0309202b8db34784a2efd305ff730cf081c1e70dd2f0339349
Malware Config
Extracted
xloader
2.5
ariv
validationlinkedterms.xyz
essentialpraxis.com
kjbservicesmn.com
wikiofgames.com
familiapena2475.com
xn--yckc3am9f2et438ajmxc.xyz
fluxmmaoffers.com
absampee43.com
videofx.store
metropolitanprofitness.com
fc8fla8kzq.com
espotplay.com
ammarus.com
tangerineharbor.com
esvengineers.com
bullfrogoutdoors.com
beefdiets.quest
958kk.com
triptoursportsaid.com
vestontalons.com
macallanwhiskysuppliers.com
documentrus.com
suddennnnnnnnnnnn36.xyz
68127.online
fombge.com
tigatek-ev.com
absender.digital
remote-soc.com
allfivestarnails.com
opurtnsdqr.icu
druvajtteet.quest
cplbet168.xyz
tomrose.net
official-dyson.online
downlownft.com
bettingsoftwareshop.com
in-cranium.com
nouvec.com
timberwolfcanada.com
theprosperityrevolution.com
yourfamilylook.com
comidie.com
mytechmadesimple.com
builtbyfable.com
arsebangers.com
drbnkrs.com
allcoasttowingfl.com
old038359222.com
abodhakujena.com
newearthhg.com
letyoursoulcontrol.com
insight-j.com
adfslab.cloud
glowiebyher.com
weixiaotuo.com
fltsavionics.com
stuiversuitvaart.com
csrrealestatemx.com
hairbeauty-city.com
calwim.com
linwuyayz.com
interstate-ts.com
mien-atelier.com
neatbourbonpodcast.com
my163111.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1648-57-0x00000000005B0000-0x00000000005CB000-memory.dmp modiloader_stage1 behavioral1/memory/1648-66-0x00000000005B0000-0x00000000005CB000-memory.dmp modiloader_stage1 behavioral1/memory/1648-65-0x00000000005B0000-0x00000000005CB000-memory.dmp modiloader_stage1 behavioral1/memory/1648-64-0x00000000005B0000-0x00000000005CB000-memory.dmp modiloader_stage1 behavioral1/memory/1648-63-0x00000000005B0000-0x00000000005CB000-memory.dmp modiloader_stage1 behavioral1/memory/1648-62-0x00000000005B0000-0x00000000005CB000-memory.dmp modiloader_stage1 behavioral1/memory/1648-61-0x00000000005B0000-0x00000000005CB000-memory.dmp modiloader_stage1 -
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1056-76-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/1128-82-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
626e958b355520e458a5a04ef1b3eade.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Luhtvxrckv = "C:\\Users\\Admin\\Contacts\\vkcrxvthuL.url" 626e958b355520e458a5a04ef1b3eade.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
DpiScaling.exewlanext.exedescription pid process target process PID 1056 set thread context of 1360 1056 DpiScaling.exe Explorer.EXE PID 1128 set thread context of 1360 1128 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
DpiScaling.exewlanext.exepid process 1056 DpiScaling.exe 1056 DpiScaling.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe 1128 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DpiScaling.exewlanext.exepid process 1056 DpiScaling.exe 1056 DpiScaling.exe 1056 DpiScaling.exe 1128 wlanext.exe 1128 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DpiScaling.exewlanext.exedescription pid process Token: SeDebugPrivilege 1056 DpiScaling.exe Token: SeDebugPrivilege 1128 wlanext.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
626e958b355520e458a5a04ef1b3eade.exeExplorer.EXEwlanext.exedescription pid process target process PID 1648 wrote to memory of 1056 1648 626e958b355520e458a5a04ef1b3eade.exe DpiScaling.exe PID 1648 wrote to memory of 1056 1648 626e958b355520e458a5a04ef1b3eade.exe DpiScaling.exe PID 1648 wrote to memory of 1056 1648 626e958b355520e458a5a04ef1b3eade.exe DpiScaling.exe PID 1648 wrote to memory of 1056 1648 626e958b355520e458a5a04ef1b3eade.exe DpiScaling.exe PID 1648 wrote to memory of 1056 1648 626e958b355520e458a5a04ef1b3eade.exe DpiScaling.exe PID 1648 wrote to memory of 1056 1648 626e958b355520e458a5a04ef1b3eade.exe DpiScaling.exe PID 1648 wrote to memory of 1056 1648 626e958b355520e458a5a04ef1b3eade.exe DpiScaling.exe PID 1360 wrote to memory of 1128 1360 Explorer.EXE wlanext.exe PID 1360 wrote to memory of 1128 1360 Explorer.EXE wlanext.exe PID 1360 wrote to memory of 1128 1360 Explorer.EXE wlanext.exe PID 1360 wrote to memory of 1128 1360 Explorer.EXE wlanext.exe PID 1128 wrote to memory of 1004 1128 wlanext.exe cmd.exe PID 1128 wrote to memory of 1004 1128 wlanext.exe cmd.exe PID 1128 wrote to memory of 1004 1128 wlanext.exe cmd.exe PID 1128 wrote to memory of 1004 1128 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\626e958b355520e458a5a04ef1b3eade.exe"C:\Users\Admin\AppData\Local\Temp\626e958b355520e458a5a04ef1b3eade.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-72-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1056-79-0x0000000000250000-0x0000000000261000-memory.dmpFilesize
68KB
-
memory/1056-78-0x0000000001F80000-0x0000000002283000-memory.dmpFilesize
3.0MB
-
memory/1056-76-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/1056-75-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/1056-71-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/1128-84-0x0000000000440000-0x0000000000B21000-memory.dmpFilesize
6.9MB
-
memory/1128-82-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1128-83-0x0000000000B30000-0x0000000000E33000-memory.dmpFilesize
3.0MB
-
memory/1128-81-0x0000000000E50000-0x0000000000E66000-memory.dmpFilesize
88KB
-
memory/1360-80-0x0000000006B60000-0x0000000006CBE000-memory.dmpFilesize
1.4MB
-
memory/1360-85-0x0000000006D80000-0x0000000006EE6000-memory.dmpFilesize
1.4MB
-
memory/1648-61-0x00000000005B0000-0x00000000005CB000-memory.dmpFilesize
108KB
-
memory/1648-62-0x00000000005B0000-0x00000000005CB000-memory.dmpFilesize
108KB
-
memory/1648-63-0x00000000005B0000-0x00000000005CB000-memory.dmpFilesize
108KB
-
memory/1648-64-0x00000000005B0000-0x00000000005CB000-memory.dmpFilesize
108KB
-
memory/1648-54-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/1648-65-0x00000000005B0000-0x00000000005CB000-memory.dmpFilesize
108KB
-
memory/1648-66-0x00000000005B0000-0x00000000005CB000-memory.dmpFilesize
108KB
-
memory/1648-57-0x00000000005B0000-0x00000000005CB000-memory.dmpFilesize
108KB
-
memory/1648-55-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB