Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 13:41
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe
Resource
win7-20220414-en
General
-
Target
SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe
-
Size
924KB
-
MD5
4e13d4aa0427eb41203deb4d021ec71c
-
SHA1
12762fa4762e1c1a16cc31656e7a80b7a2428fb5
-
SHA256
d25d2c22b3843c1e8aaecec11b29d4ebb6fbe5b67a6f5a345abf0709516920d3
-
SHA512
4555a7e0dee519f47e92abc7360cb2a48809ccc3cefd12c0146a58f9a8154e9da7f386b002e5e19fede969ded728c06f186331f75d0c415353daab724bed1510
Malware Config
Extracted
xloader
2.7
n5mz
ezhuilike.com
broomstickrum.com
ramaniclothing.com
midbots.com
rlxscpe.com
elanagro.online
chahuajie.com
digipubcity.com
predatorstoppers.com
savas-jewelry.com
timinis23.com
homesteaddesignstudio.net
bellezadehoy.online
disintar.xyz
sharinks.tech
redfoxdetroit.com
resscoptheron.com
aspiritualgiftshoppe.com
tematemazo.com
assasa.net
rogfinance.info
ms7779.com
100shortvideos.com
funandfoodboat.com
hubinvoice.com
geroofl.com
unitedoceanlogistics.com
vineabank.com
manchimaata.com
comproorohuelva.com
schooledwriters.com
pastafrescabg.com
no-website-yet.com
waydiscount3.xyz
shroommhc.com
letbeautifyus.com
1869114763.xyz
gasurvivalgear.com
usdtsearch.com
bluewavewoodrow.com
shumeldavisual.com
onlinedegreesukr.com
iden3s.com
kathhyhenslee.com
norskeplanteskoler.online
fullsexzone.net
ssq0973.com
hayatcevredanismanlik.com
pageone.life
takeka.com
karbies.com
augustamobilenotary.net
equipoheza.com
thewoodlandsmusiclessons.com
albemale.com
chaobomedia.com
hg06809.com
icarus-soft.com
duckholland.com
profoxwebdesigner.online
admoola.com
ds922.com
antipeek.net
fanjingdesigner.com
sinibelanja.website
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
ModiLoader Second Stage 38 IoCs
Processes:
resource yara_rule behavioral1/memory/880-65-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-66-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-68-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-67-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-70-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-72-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-71-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-69-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-76-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-75-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-74-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-73-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-79-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-80-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-78-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-77-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-83-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-84-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-82-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-81-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-85-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-87-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-86-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-89-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-88-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-90-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-96-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-97-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-98-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-99-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-100-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-110-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-109-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-111-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-113-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-114-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-115-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 behavioral1/memory/880-116-0x0000000004580000-0x00000000045D2000-memory.dmp modiloader_stage2 -
Xloader Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/880-92-0x0000000010410000-0x000000001043B000-memory.dmp xloader behavioral1/memory/1536-95-0x0000000000000000-mapping.dmp xloader behavioral1/memory/1536-119-0x0000000010410000-0x000000001043B000-memory.dmp xloader behavioral1/memory/1536-123-0x0000000010410000-0x000000001043B000-memory.dmp xloader behavioral1/memory/1616-127-0x0000000000080000-0x00000000000AB000-memory.dmp xloader behavioral1/memory/1616-130-0x0000000000080000-0x00000000000AB000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
help.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run help.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YZZXVZJ0F = "C:\\Program Files (x86)\\Alds\\vga8pj81.exe" help.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
logagent.exehelp.exedescription pid process target process PID 1536 set thread context of 1312 1536 logagent.exe Explorer.EXE PID 1536 set thread context of 1312 1536 logagent.exe Explorer.EXE PID 1616 set thread context of 1312 1616 help.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
help.exedescription ioc process File opened for modification C:\Program Files (x86)\Alds\vga8pj81.exe help.exe -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
logagent.exehelp.exepid process 1536 logagent.exe 1536 logagent.exe 1536 logagent.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
logagent.exehelp.exepid process 1536 logagent.exe 1536 logagent.exe 1536 logagent.exe 1536 logagent.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.exehelp.exedescription pid process Token: SeDebugPrivilege 1536 logagent.exe Token: SeDebugPrivilege 1616 help.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exeExplorer.EXEhelp.exedescription pid process target process PID 880 wrote to memory of 1536 880 SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe logagent.exe PID 880 wrote to memory of 1536 880 SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe logagent.exe PID 880 wrote to memory of 1536 880 SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe logagent.exe PID 880 wrote to memory of 1536 880 SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe logagent.exe PID 880 wrote to memory of 1536 880 SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe logagent.exe PID 880 wrote to memory of 1536 880 SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe logagent.exe PID 880 wrote to memory of 1536 880 SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe logagent.exe PID 1312 wrote to memory of 1616 1312 Explorer.EXE help.exe PID 1312 wrote to memory of 1616 1312 Explorer.EXE help.exe PID 1312 wrote to memory of 1616 1312 Explorer.EXE help.exe PID 1312 wrote to memory of 1616 1312 Explorer.EXE help.exe PID 1616 wrote to memory of 2040 1616 help.exe cmd.exe PID 1616 wrote to memory of 2040 1616 help.exe cmd.exe PID 1616 wrote to memory of 2040 1616 help.exe cmd.exe PID 1616 wrote to memory of 2040 1616 help.exe cmd.exe PID 1616 wrote to memory of 112 1616 help.exe Firefox.exe PID 1616 wrote to memory of 112 1616 help.exe Firefox.exe PID 1616 wrote to memory of 112 1616 help.exe Firefox.exe PID 1616 wrote to memory of 112 1616 help.exe Firefox.exe PID 1616 wrote to memory of 112 1616 help.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/880-116-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-67-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-54-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/880-68-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-115-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-70-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-72-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-71-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-69-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-76-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-75-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-74-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-73-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-79-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-80-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-78-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-77-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-83-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-84-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-82-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-81-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-85-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-87-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-86-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-96-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-88-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-90-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-92-0x0000000010410000-0x000000001043B000-memory.dmpFilesize
172KB
-
memory/880-66-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-65-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-89-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-97-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-98-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-99-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-100-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-114-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-110-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-109-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-111-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/880-113-0x0000000004580000-0x00000000045D2000-memory.dmpFilesize
328KB
-
memory/1312-131-0x00000000039E0000-0x0000000003A7E000-memory.dmpFilesize
632KB
-
memory/1312-118-0x0000000004AB0000-0x0000000004B5F000-memory.dmpFilesize
700KB
-
memory/1312-129-0x00000000039E0000-0x0000000003A7E000-memory.dmpFilesize
632KB
-
memory/1312-121-0x0000000004C70000-0x0000000004DA6000-memory.dmpFilesize
1.2MB
-
memory/1536-93-0x0000000010410000-0x000000001043B000-memory.dmpFilesize
172KB
-
memory/1536-119-0x0000000010410000-0x000000001043B000-memory.dmpFilesize
172KB
-
memory/1536-120-0x00000000002C0000-0x00000000002D1000-memory.dmpFilesize
68KB
-
memory/1536-95-0x0000000000000000-mapping.dmp
-
memory/1536-102-0x0000000002050000-0x0000000002353000-memory.dmpFilesize
3.0MB
-
memory/1536-123-0x0000000010410000-0x000000001043B000-memory.dmpFilesize
172KB
-
memory/1536-117-0x00000000001C0000-0x00000000001D1000-memory.dmpFilesize
68KB
-
memory/1616-125-0x0000000000960000-0x0000000000C63000-memory.dmpFilesize
3.0MB
-
memory/1616-126-0x00000000006A0000-0x00000000006A6000-memory.dmpFilesize
24KB
-
memory/1616-127-0x0000000000080000-0x00000000000AB000-memory.dmpFilesize
172KB
-
memory/1616-128-0x00000000004B0000-0x0000000000540000-memory.dmpFilesize
576KB
-
memory/1616-130-0x0000000000080000-0x00000000000AB000-memory.dmpFilesize
172KB
-
memory/1616-122-0x0000000000000000-mapping.dmp
-
memory/2040-124-0x0000000000000000-mapping.dmp