Analysis
- max time kernel
89s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
24/06/2022, 09:24
General
- Target FAKTURA.exe
- Size 799KB
- Sample220624-lc2m4abdbk
- SHA256 0866933e41e1dd10e549490bddfa31ea6c5f500051fc877e0ef2e68077aa29f0
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- ModiLoader Second Stage 39 IoCs
- Warzone RAT Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FAKTURA.exe"C:\Users\Admin\AppData\Local\Temp\FAKTURA.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3092-191-0x0000000000400000-0x0000000000559000-memory.dmp
memory/3092-190-0x000000000A880000-0x000000000AA20000-memory.dmp
memory/3092-189-0x0000000000400000-0x0000000000559000-memory.dmp
memory/3092-188-0x0000000010670000-0x00000000107CB000-memory.dmp
memory/3816-162-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-164-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-144-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-149-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-148-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-150-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-151-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-152-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-153-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-154-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-155-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-157-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-156-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-158-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-159-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-160-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-161-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-140-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-163-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-147-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-165-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-146-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-168-0x0000000010670000-0x00000000107CB000-memory.dmp
memory/3816-169-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-170-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-171-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-172-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-173-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-180-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-181-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-182-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-184-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-183-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-185-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-186-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-187-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-145-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-143-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-142-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/3816-141-0x00000000056B0000-0x00000000056FB000-memory.dmp