Analysis
-
max time kernel
173s -
max time network
188s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 07:54
Static task
static1
Behavioral task
behavioral1
Sample
PI02627625141.PDF.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
PI02627625141.PDF.exe
Resource
win10-en-20211208
General
-
Target
PI02627625141.PDF.exe
-
Size
869KB
-
MD5
3509f4a8256a2bab3ee4cd387e22e5d4
-
SHA1
640fea7748e2fa6e2780ddb1d5c9808d55a33b92
-
SHA256
5a04697834016e869389ef0d6a08656669cf5597fe0a6378a993250d311482e3
-
SHA512
d5dd08dcaaa33a877f3f0a2cd94f60c6c35831b5feb8a51148d2918aa392827e83339a681a2ef846bb6b9dfaf1a5d4fa3989b5b246a9ba4e4446eaf2be64fb11
Malware Config
Extracted
xloader
2.5
euv4
anniebapartments.com
hagenbicycles.com
herbalist101.com
southerncorrosion.net
kuechenpruefer.com
tajniezdrzi.quest
segurofunerarioar.com
boardsandbeamsdecor.com
alifdanismanlik.com
pkem.top
mddc.clinic
handejqr.com
crux-at.com
awp.email
hugsforbubbs.com
cielotherepy.com
turkcuyuz.com
teamidc.com
lankasirinspa.com
68135.online
oprimanumerodos.com
launchclik.com
customapronsnow.com
thecuratedpour.com
20dzwww.com
encludemedia.com
kreativevisibility.net
mehfeels.com
oecmgroup.com
alert78.info
1207rossmoyne.com
spbutoto.com
t1uba.com
protection-onepa.com
byausorsm26-plala.xyz
bestpleasure4u.com
allmnlenem.quest
mobilpartes.com
fabio.tools
bubu3cin.com
nathanmartinez.digital
shristiprintingplaces.com
silkyflawless.com
berylgrote.top
laidbackfurniture.store
leatherman-neal.com
uschargeport.com
the-pumps.com
deepootech.com
drimev.com
seo-art.agency
jasabacklinkweb20.com
tracynicolalamond.com
dandtglaziers.com
vulacils.com
bendyourtongue.com
gulfund.com
ahmadfaizlajis.com
595531.com
metavillagehub.com
librairie-adrienne.com
77777.store
gongwenbo.com
game2plays.com
rematedeldia.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 7 IoCs
Processes:
resource yara_rule behavioral2/memory/760-120-0x0000000002520000-0x000000000253B000-memory.dmp modiloader_stage1 behavioral2/memory/760-171-0x0000000002520000-0x000000000253B000-memory.dmp modiloader_stage1 behavioral2/memory/760-173-0x0000000002520000-0x000000000253B000-memory.dmp modiloader_stage1 behavioral2/memory/760-172-0x0000000002520000-0x000000000253B000-memory.dmp modiloader_stage1 behavioral2/memory/760-174-0x0000000002520000-0x000000000253B000-memory.dmp modiloader_stage1 behavioral2/memory/760-175-0x0000000002520000-0x000000000253B000-memory.dmp modiloader_stage1 behavioral2/memory/760-176-0x0000000002520000-0x000000000253B000-memory.dmp modiloader_stage1 -
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1212-214-0x0000000073B00000-0x0000000073B29000-memory.dmp xloader behavioral2/memory/1212-217-0x0000000000E40000-0x0000000000EA7000-memory.dmp xloader behavioral2/memory/1428-220-0x0000000003330000-0x0000000003359000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PI02627625141.PDF.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aiuoaatifg = "C:\\Users\\Admin\\Contacts\\gfitaaouiA.url" PI02627625141.PDF.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
logagent.execscript.exedescription pid process target process PID 1212 set thread context of 3052 1212 logagent.exe Explorer.EXE PID 1428 set thread context of 3052 1428 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
logagent.execscript.exepid process 1212 logagent.exe 1212 logagent.exe 1212 logagent.exe 1212 logagent.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe 1428 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
logagent.execscript.exepid process 1212 logagent.exe 1212 logagent.exe 1212 logagent.exe 1428 cscript.exe 1428 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.execscript.exedescription pid process Token: SeDebugPrivilege 1212 logagent.exe Token: SeDebugPrivilege 1428 cscript.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PI02627625141.PDF.exeExplorer.EXEcscript.exedescription pid process target process PID 760 wrote to memory of 1212 760 PI02627625141.PDF.exe logagent.exe PID 760 wrote to memory of 1212 760 PI02627625141.PDF.exe logagent.exe PID 760 wrote to memory of 1212 760 PI02627625141.PDF.exe logagent.exe PID 760 wrote to memory of 1212 760 PI02627625141.PDF.exe logagent.exe PID 760 wrote to memory of 1212 760 PI02627625141.PDF.exe logagent.exe PID 760 wrote to memory of 1212 760 PI02627625141.PDF.exe logagent.exe PID 3052 wrote to memory of 1428 3052 Explorer.EXE cscript.exe PID 3052 wrote to memory of 1428 3052 Explorer.EXE cscript.exe PID 3052 wrote to memory of 1428 3052 Explorer.EXE cscript.exe PID 1428 wrote to memory of 1664 1428 cscript.exe cmd.exe PID 1428 wrote to memory of 1664 1428 cscript.exe cmd.exe PID 1428 wrote to memory of 1664 1428 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI02627625141.PDF.exe"C:\Users\Admin\AppData\Local\Temp\PI02627625141.PDF.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-118-0x00000000004F0000-0x000000000059E000-memory.dmpFilesize
696KB
-
memory/760-120-0x0000000002520000-0x000000000253B000-memory.dmpFilesize
108KB
-
memory/760-171-0x0000000002520000-0x000000000253B000-memory.dmpFilesize
108KB
-
memory/760-173-0x0000000002520000-0x000000000253B000-memory.dmpFilesize
108KB
-
memory/760-172-0x0000000002520000-0x000000000253B000-memory.dmpFilesize
108KB
-
memory/760-174-0x0000000002520000-0x000000000253B000-memory.dmpFilesize
108KB
-
memory/760-175-0x0000000002520000-0x000000000253B000-memory.dmpFilesize
108KB
-
memory/760-176-0x0000000002520000-0x000000000253B000-memory.dmpFilesize
108KB
-
memory/1212-213-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/1212-214-0x0000000073B00000-0x0000000073B29000-memory.dmpFilesize
164KB
-
memory/1212-216-0x0000000004A30000-0x0000000004D50000-memory.dmpFilesize
3.1MB
-
memory/1212-217-0x0000000000E40000-0x0000000000EA7000-memory.dmpFilesize
412KB
-
memory/1428-219-0x0000000000310000-0x0000000000337000-memory.dmpFilesize
156KB
-
memory/1428-220-0x0000000003330000-0x0000000003359000-memory.dmpFilesize
164KB
-
memory/1428-221-0x00000000049E0000-0x0000000004D00000-memory.dmpFilesize
3.1MB
-
memory/1428-222-0x0000000004D90000-0x0000000004E20000-memory.dmpFilesize
576KB
-
memory/3052-218-0x00000000032B0000-0x0000000003392000-memory.dmpFilesize
904KB
-
memory/3052-223-0x0000000001450000-0x0000000001500000-memory.dmpFilesize
704KB