Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21/06/2022, 08:49

General

  • Target

    149d29a68788c9cd599cba389698ed47.exe

  • Size

    241KB

  • MD5

    149d29a68788c9cd599cba389698ed47

  • SHA1

    cad8135bbbee484b91b87df367631b9043c2f403

  • SHA256

    b92800b4c8d2200d261f52287439016dc29ba57a73d428015ab05ee98a19c159

  • SHA512

    6026a7692a4a745518f2c8404a1c4b4c08e8c66f2d6fe0c9385c73d8a125bb26bba8496b4f9a492d3c8bc73140ba2173d3583435318245fe5ea0004e51a916c7

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

gqvv

Decoy

keyclash.com

canadianinspiration.com

testmanagement.xyz

doxpunk.xyz

kodacult.com

snatchbra.net

313370955.com

sarochin.com

norozoto.xyz

nbpanthers.com

colombiaartesanias.com

m57hwtiuu7h.com

tsaerac.com

alugiare.com

elizeusomautomotivo.com

fgijjisdifsd.xyz

isecurewebsites.com

incomeviaonline.com

caribbeanbrunch.com

alveus-solarboote.com

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • ModiLoader Second Stage 39 IoCs
  • Xloader Payload 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Users\Admin\AppData\Local\Temp\149d29a68788c9cd599cba389698ed47.exe
      "C:\Users\Admin\AppData\Local\Temp\149d29a68788c9cd599cba389698ed47.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Windows\SysWOW64\DpiScaling.exe
        C:\Windows\System32\DpiScaling.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2252
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\DpiScaling.exe"
        3⤵
          PID:3760
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:528
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:4816
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:1396
            • C:\Program Files (x86)\Sfzl\c8tplrsv14i08.exe
              "C:\Program Files (x86)\Sfzl\c8tplrsv14i08.exe"
              2⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:2576
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe" ms-settings:display
                3⤵
                  PID:2692
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
                PID:5116
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
                1⤵
                  PID:2024

                Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files (x86)\Sfzl\c8tplrsv14i08.exe

                        Filesize

                        75KB

                        MD5

                        d44d3a0f5e53f6ecc5c6232930cfcc5e

                        SHA1

                        d42b4fc663fb0328a2307ec7c8f56f220872d953

                        SHA256

                        fa1dd224289d1c39c49cb5dd2896fa19a3091ce650d6b665626d5d30b65dee9e

                        SHA512

                        a4104e8abb58d17d6565a410a5e4653280827d2291bfedb59201e368dce475b43b79fdd3087dce46c8e0a95cad78afb15e0c1fb351babd7168e39e26ef861af6

                      • C:\Program Files (x86)\Sfzl\c8tplrsv14i08.exe

                        Filesize

                        75KB

                        MD5

                        d44d3a0f5e53f6ecc5c6232930cfcc5e

                        SHA1

                        d42b4fc663fb0328a2307ec7c8f56f220872d953

                        SHA256

                        fa1dd224289d1c39c49cb5dd2896fa19a3091ce650d6b665626d5d30b65dee9e

                        SHA512

                        a4104e8abb58d17d6565a410a5e4653280827d2291bfedb59201e368dce475b43b79fdd3087dce46c8e0a95cad78afb15e0c1fb351babd7168e39e26ef861af6

                      • C:\Users\Admin\AppData\Local\Temp\DB1

                        Filesize

                        40KB

                        MD5

                        b608d407fc15adea97c26936bc6f03f6

                        SHA1

                        953e7420801c76393902c0d6bb56148947e41571

                        SHA256

                        b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                        SHA512

                        cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                      • C:\Users\Admin\AppData\Local\Temp\DB1

                        Filesize

                        48KB

                        MD5

                        349e6eb110e34a08924d92f6b334801d

                        SHA1

                        bdfb289daff51890cc71697b6322aa4b35ec9169

                        SHA256

                        c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                        SHA512

                        2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                      • memory/2252-189-0x0000000010410000-0x000000001043B000-memory.dmp

                        Filesize

                        172KB

                      • memory/2252-190-0x0000000003050000-0x000000000339A000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/2252-191-0x0000000001410000-0x0000000001421000-memory.dmp

                        Filesize

                        68KB

                      • memory/2684-192-0x00000000082A0000-0x00000000083CE000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2684-202-0x0000000008560000-0x00000000086C5000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/2684-200-0x0000000008560000-0x00000000086C5000-memory.dmp

                        Filesize

                        1.4MB

                      • memory/2684-198-0x00000000082A0000-0x00000000083CE000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/4708-165-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-182-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-152-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-154-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-156-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-155-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-158-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-157-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-159-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-160-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-161-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-162-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-163-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-164-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-151-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-167-0x0000000010410000-0x000000001043B000-memory.dmp

                        Filesize

                        172KB

                      • memory/4708-170-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-169-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-171-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-172-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-173-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-180-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-181-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-153-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-183-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-184-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-185-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-186-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-187-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-140-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-141-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-142-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-150-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-143-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-149-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-144-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-148-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-145-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-147-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4708-146-0x0000000003900000-0x0000000003952000-memory.dmp

                        Filesize

                        328KB

                      • memory/4888-201-0x0000000000F60000-0x0000000000F8B000-memory.dmp

                        Filesize

                        172KB

                      • memory/4888-199-0x0000000003020000-0x00000000030B0000-memory.dmp

                        Filesize

                        576KB

                      • memory/4888-197-0x00000000031F0000-0x000000000353A000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/4888-195-0x0000000000F60000-0x0000000000F8B000-memory.dmp

                        Filesize

                        172KB

                      • memory/4888-194-0x0000000000FD0000-0x000000000110A000-memory.dmp

                        Filesize

                        1.2MB