Analysis
-
max time kernel
158s -
max time network
178s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 07:54
Static task
static1
Behavioral task
behavioral1
Sample
PI02627625141.PDF.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
PI02627625141.PDF.exe
Resource
win10-en-20211208
General
-
Target
PI02627625141.PDF.exe
-
Size
869KB
-
MD5
3509f4a8256a2bab3ee4cd387e22e5d4
-
SHA1
640fea7748e2fa6e2780ddb1d5c9808d55a33b92
-
SHA256
5a04697834016e869389ef0d6a08656669cf5597fe0a6378a993250d311482e3
-
SHA512
d5dd08dcaaa33a877f3f0a2cd94f60c6c35831b5feb8a51148d2918aa392827e83339a681a2ef846bb6b9dfaf1a5d4fa3989b5b246a9ba4e4446eaf2be64fb11
Malware Config
Extracted
xloader
2.5
euv4
anniebapartments.com
hagenbicycles.com
herbalist101.com
southerncorrosion.net
kuechenpruefer.com
tajniezdrzi.quest
segurofunerarioar.com
boardsandbeamsdecor.com
alifdanismanlik.com
pkem.top
mddc.clinic
handejqr.com
crux-at.com
awp.email
hugsforbubbs.com
cielotherepy.com
turkcuyuz.com
teamidc.com
lankasirinspa.com
68135.online
oprimanumerodos.com
launchclik.com
customapronsnow.com
thecuratedpour.com
20dzwww.com
encludemedia.com
kreativevisibility.net
mehfeels.com
oecmgroup.com
alert78.info
1207rossmoyne.com
spbutoto.com
t1uba.com
protection-onepa.com
byausorsm26-plala.xyz
bestpleasure4u.com
allmnlenem.quest
mobilpartes.com
fabio.tools
bubu3cin.com
nathanmartinez.digital
shristiprintingplaces.com
silkyflawless.com
berylgrote.top
laidbackfurniture.store
leatherman-neal.com
uschargeport.com
the-pumps.com
deepootech.com
drimev.com
seo-art.agency
jasabacklinkweb20.com
tracynicolalamond.com
dandtglaziers.com
vulacils.com
bendyourtongue.com
gulfund.com
ahmadfaizlajis.com
595531.com
metavillagehub.com
librairie-adrienne.com
77777.store
gongwenbo.com
game2plays.com
rematedeldia.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-57-0x00000000005D0000-0x00000000005EB000-memory.dmp modiloader_stage1 behavioral1/memory/1704-64-0x00000000005D0000-0x00000000005EB000-memory.dmp modiloader_stage1 behavioral1/memory/1704-63-0x00000000005D0000-0x00000000005EB000-memory.dmp modiloader_stage1 behavioral1/memory/1704-62-0x00000000005D0000-0x00000000005EB000-memory.dmp modiloader_stage1 behavioral1/memory/1704-61-0x00000000005D0000-0x00000000005EB000-memory.dmp modiloader_stage1 behavioral1/memory/1704-66-0x00000000005D0000-0x00000000005EB000-memory.dmp modiloader_stage1 behavioral1/memory/1704-65-0x00000000005D0000-0x00000000005EB000-memory.dmp modiloader_stage1 -
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1272-80-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/1200-86-0x0000000000120000-0x0000000000149000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PI02627625141.PDF.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aiuoaatifg = "C:\\Users\\Admin\\Contacts\\gfitaaouiA.url" PI02627625141.PDF.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
logagent.exechkdsk.exedescription pid process target process PID 1272 set thread context of 1384 1272 logagent.exe Explorer.EXE PID 1200 set thread context of 1384 1200 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
logagent.exechkdsk.exepid process 1272 logagent.exe 1272 logagent.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe 1200 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
logagent.exechkdsk.exepid process 1272 logagent.exe 1272 logagent.exe 1272 logagent.exe 1200 chkdsk.exe 1200 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1272 logagent.exe Token: SeDebugPrivilege 1200 chkdsk.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PI02627625141.PDF.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1704 wrote to memory of 1272 1704 PI02627625141.PDF.exe logagent.exe PID 1704 wrote to memory of 1272 1704 PI02627625141.PDF.exe logagent.exe PID 1704 wrote to memory of 1272 1704 PI02627625141.PDF.exe logagent.exe PID 1704 wrote to memory of 1272 1704 PI02627625141.PDF.exe logagent.exe PID 1704 wrote to memory of 1272 1704 PI02627625141.PDF.exe logagent.exe PID 1704 wrote to memory of 1272 1704 PI02627625141.PDF.exe logagent.exe PID 1704 wrote to memory of 1272 1704 PI02627625141.PDF.exe logagent.exe PID 1384 wrote to memory of 1200 1384 Explorer.EXE chkdsk.exe PID 1384 wrote to memory of 1200 1384 Explorer.EXE chkdsk.exe PID 1384 wrote to memory of 1200 1384 Explorer.EXE chkdsk.exe PID 1384 wrote to memory of 1200 1384 Explorer.EXE chkdsk.exe PID 1200 wrote to memory of 1844 1200 chkdsk.exe cmd.exe PID 1200 wrote to memory of 1844 1200 chkdsk.exe cmd.exe PID 1200 wrote to memory of 1844 1200 chkdsk.exe cmd.exe PID 1200 wrote to memory of 1844 1200 chkdsk.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI02627625141.PDF.exe"C:\Users\Admin\AppData\Local\Temp\PI02627625141.PDF.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-88-0x00000000007F0000-0x0000000000A2C000-memory.dmpFilesize
2.2MB
-
memory/1200-87-0x0000000002150000-0x0000000002453000-memory.dmpFilesize
3.0MB
-
memory/1200-85-0x0000000000D40000-0x0000000000D47000-memory.dmpFilesize
28KB
-
memory/1200-86-0x0000000000120000-0x0000000000149000-memory.dmpFilesize
164KB
-
memory/1272-75-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1272-83-0x00000000002B0000-0x00000000002C1000-memory.dmpFilesize
68KB
-
memory/1272-81-0x0000000002380000-0x0000000002683000-memory.dmpFilesize
3.0MB
-
memory/1272-80-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/1272-79-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/1272-74-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/1384-84-0x0000000007050000-0x00000000071EF000-memory.dmpFilesize
1.6MB
-
memory/1384-89-0x0000000004730000-0x0000000004848000-memory.dmpFilesize
1.1MB
-
memory/1704-65-0x00000000005D0000-0x00000000005EB000-memory.dmpFilesize
108KB
-
memory/1704-66-0x00000000005D0000-0x00000000005EB000-memory.dmpFilesize
108KB
-
memory/1704-61-0x00000000005D0000-0x00000000005EB000-memory.dmpFilesize
108KB
-
memory/1704-62-0x00000000005D0000-0x00000000005EB000-memory.dmpFilesize
108KB
-
memory/1704-54-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1704-63-0x00000000005D0000-0x00000000005EB000-memory.dmpFilesize
108KB
-
memory/1704-64-0x00000000005D0000-0x00000000005EB000-memory.dmpFilesize
108KB
-
memory/1704-57-0x00000000005D0000-0x00000000005EB000-memory.dmpFilesize
108KB
-
memory/1704-55-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB