Analysis
-
max time kernel
151s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 09:37
Static task
static1
Behavioral task
behavioral1
Sample
626e958b355520e458a5a04ef1b3eade.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
626e958b355520e458a5a04ef1b3eade.exe
Resource
win10-en-20211208
General
-
Target
626e958b355520e458a5a04ef1b3eade.exe
-
Size
779KB
-
MD5
626e958b355520e458a5a04ef1b3eade
-
SHA1
4feb6d823b5370e509907b4cdfd8d0922d96ac11
-
SHA256
74f9f40a7808dde465c27d303835332b0d12509403d32d4a1f45ac5aaf790ff5
-
SHA512
ddda9307f420b77390cb5a3bfea9c96cdb5bb0c2daae439805770825de566a63b9141e7aa4f83a0309202b8db34784a2efd305ff730cf081c1e70dd2f0339349
Malware Config
Extracted
xloader
2.5
ariv
validationlinkedterms.xyz
essentialpraxis.com
kjbservicesmn.com
wikiofgames.com
familiapena2475.com
xn--yckc3am9f2et438ajmxc.xyz
fluxmmaoffers.com
absampee43.com
videofx.store
metropolitanprofitness.com
fc8fla8kzq.com
espotplay.com
ammarus.com
tangerineharbor.com
esvengineers.com
bullfrogoutdoors.com
beefdiets.quest
958kk.com
triptoursportsaid.com
vestontalons.com
macallanwhiskysuppliers.com
documentrus.com
suddennnnnnnnnnnn36.xyz
68127.online
fombge.com
tigatek-ev.com
absender.digital
remote-soc.com
allfivestarnails.com
opurtnsdqr.icu
druvajtteet.quest
cplbet168.xyz
tomrose.net
official-dyson.online
downlownft.com
bettingsoftwareshop.com
in-cranium.com
nouvec.com
timberwolfcanada.com
theprosperityrevolution.com
yourfamilylook.com
comidie.com
mytechmadesimple.com
builtbyfable.com
arsebangers.com
drbnkrs.com
allcoasttowingfl.com
old038359222.com
abodhakujena.com
newearthhg.com
letyoursoulcontrol.com
insight-j.com
adfslab.cloud
glowiebyher.com
weixiaotuo.com
fltsavionics.com
stuiversuitvaart.com
csrrealestatemx.com
hairbeauty-city.com
calwim.com
linwuyayz.com
interstate-ts.com
mien-atelier.com
neatbourbonpodcast.com
my163111.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 7 IoCs
Processes:
resource yara_rule behavioral2/memory/3240-117-0x0000000002400000-0x000000000241B000-memory.dmp modiloader_stage1 behavioral2/memory/3240-172-0x0000000002400000-0x000000000241B000-memory.dmp modiloader_stage1 behavioral2/memory/3240-174-0x0000000002400000-0x000000000241B000-memory.dmp modiloader_stage1 behavioral2/memory/3240-175-0x0000000002400000-0x000000000241B000-memory.dmp modiloader_stage1 behavioral2/memory/3240-176-0x0000000002400000-0x000000000241B000-memory.dmp modiloader_stage1 behavioral2/memory/3240-177-0x0000000002400000-0x000000000241B000-memory.dmp modiloader_stage1 behavioral2/memory/3240-173-0x0000000002400000-0x000000000241B000-memory.dmp modiloader_stage1 -
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3240-186-0x00000000006C0000-0x0000000000737000-memory.dmp modiloader_stage2 -
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4004-225-0x0000000073C00000-0x0000000073C29000-memory.dmp xloader behavioral2/memory/4004-230-0x0000000073C00000-0x0000000073C29000-memory.dmp xloader behavioral2/memory/708-234-0x00000000008E0000-0x0000000000909000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
626e958b355520e458a5a04ef1b3eade.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Luhtvxrckv = "C:\\Users\\Admin\\Contacts\\vkcrxvthuL.url" 626e958b355520e458a5a04ef1b3eade.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
logagent.exeraserver.exedescription pid process target process PID 4004 set thread context of 2472 4004 logagent.exe Explorer.EXE PID 4004 set thread context of 2472 4004 logagent.exe Explorer.EXE PID 708 set thread context of 2472 708 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
logagent.exeraserver.exepid process 4004 logagent.exe 4004 logagent.exe 4004 logagent.exe 4004 logagent.exe 4004 logagent.exe 4004 logagent.exe 708 raserver.exe 708 raserver.exe 708 raserver.exe 708 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
logagent.exeraserver.exepid process 4004 logagent.exe 4004 logagent.exe 4004 logagent.exe 4004 logagent.exe 708 raserver.exe 708 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.exeraserver.exedescription pid process Token: SeDebugPrivilege 4004 logagent.exe Token: SeDebugPrivilege 708 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
626e958b355520e458a5a04ef1b3eade.exeExplorer.EXEraserver.exedescription pid process target process PID 3240 wrote to memory of 4004 3240 626e958b355520e458a5a04ef1b3eade.exe logagent.exe PID 3240 wrote to memory of 4004 3240 626e958b355520e458a5a04ef1b3eade.exe logagent.exe PID 3240 wrote to memory of 4004 3240 626e958b355520e458a5a04ef1b3eade.exe logagent.exe PID 3240 wrote to memory of 4004 3240 626e958b355520e458a5a04ef1b3eade.exe logagent.exe PID 3240 wrote to memory of 4004 3240 626e958b355520e458a5a04ef1b3eade.exe logagent.exe PID 3240 wrote to memory of 4004 3240 626e958b355520e458a5a04ef1b3eade.exe logagent.exe PID 2472 wrote to memory of 708 2472 Explorer.EXE raserver.exe PID 2472 wrote to memory of 708 2472 Explorer.EXE raserver.exe PID 2472 wrote to memory of 708 2472 Explorer.EXE raserver.exe PID 708 wrote to memory of 3500 708 raserver.exe cmd.exe PID 708 wrote to memory of 3500 708 raserver.exe cmd.exe PID 708 wrote to memory of 3500 708 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\626e958b355520e458a5a04ef1b3eade.exe"C:\Users\Admin\AppData\Local\Temp\626e958b355520e458a5a04ef1b3eade.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/708-235-0x0000000004820000-0x0000000004B40000-memory.dmpFilesize
3.1MB
-
memory/708-234-0x00000000008E0000-0x0000000000909000-memory.dmpFilesize
164KB
-
memory/708-233-0x0000000000F40000-0x0000000000F5F000-memory.dmpFilesize
124KB
-
memory/2472-229-0x0000000002C50000-0x0000000002D49000-memory.dmpFilesize
996KB
-
memory/2472-232-0x00000000064B0000-0x00000000065B3000-memory.dmpFilesize
1.0MB
-
memory/3240-174-0x0000000002400000-0x000000000241B000-memory.dmpFilesize
108KB
-
memory/3240-177-0x0000000002400000-0x000000000241B000-memory.dmpFilesize
108KB
-
memory/3240-173-0x0000000002400000-0x000000000241B000-memory.dmpFilesize
108KB
-
memory/3240-186-0x00000000006C0000-0x0000000000737000-memory.dmpFilesize
476KB
-
memory/3240-176-0x0000000002400000-0x000000000241B000-memory.dmpFilesize
108KB
-
memory/3240-115-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB
-
memory/3240-175-0x0000000002400000-0x000000000241B000-memory.dmpFilesize
108KB
-
memory/3240-172-0x0000000002400000-0x000000000241B000-memory.dmpFilesize
108KB
-
memory/3240-117-0x0000000002400000-0x000000000241B000-memory.dmpFilesize
108KB
-
memory/4004-225-0x0000000073C00000-0x0000000073C29000-memory.dmpFilesize
164KB
-
memory/4004-231-0x0000000002F80000-0x0000000002F91000-memory.dmpFilesize
68KB
-
memory/4004-230-0x0000000073C00000-0x0000000073C29000-memory.dmpFilesize
164KB
-
memory/4004-228-0x0000000002F40000-0x0000000002F51000-memory.dmpFilesize
68KB
-
memory/4004-226-0x0000000004B90000-0x0000000004EB0000-memory.dmpFilesize
3.1MB
-
memory/4004-224-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB