Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 07:33
Static task
static1
Behavioral task
behavioral1
Sample
2feb4df65e22132bda72311108f6da24.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2feb4df65e22132bda72311108f6da24.exe
Resource
win10v2004-20220414-en
General
-
Target
2feb4df65e22132bda72311108f6da24.exe
-
Size
770KB
-
MD5
2feb4df65e22132bda72311108f6da24
-
SHA1
8a165756d84094a9ac840f83fd7370f158b233c2
-
SHA256
141d09dc3b6f2084a35fbc63ea487e6786c91975ad7868caacbed9ecfa685a6b
-
SHA512
6a3b4e006fa1c411db2eab4f8ebd0f8aefc3b721c545a182e771d656a9b88e6af48d98d632f755c22f4d2bf97be4bfa57359635c226ecdc445b9390cadb61a10
Malware Config
Extracted
formbook
4.1
t3c9
waidfu.com
sjglyshsv.com
sdztgy.com
health-magazines.info
bajoarmadura.com
oxian.xyz
jonspearman.com
fusodu.online
jx1718.net
arminva6tinderella.xyz
susuhiwah.com
novotherm.online
superbloomerz.com
kuaida56.com
74hc86.com
stellumml.com
neurocalibration.com
pinkspirit.store
solitaipat.com
eassiy.com
w-coinbase.xyz
transliberation.space
food2goscunthorpeonline.com
as2082m.icu
goodhistoryhealth.com
albertojanderson.space
idc169.com
silverholleorganicfarms.com
influxpr.com
lechecondensada.info
airyflamy.com
rangersmix.com
muadogiadungtot.site
feldfire.store
splitdrinks.com
lbzyfj.com
mydailycash.online
ifa-samsung.com
bzfjm.net
001qr.com
elylil.com
coloradogives365.com
vmpapp.com
yourcoachsteph.com
annalenaroeder.com
gsolartech.com
vsecom.net
digihouse.biz
paxof.com
spectrumfxstudio.com
cwmjcs.com
borilicious.com
bigmamma1121.com
future.hockey
billionaero.com
ebavconnect.com
essntialstore.com
hillbumper.com
mlnxsw.xyz
bicyclelover.com
sabjibajar.com
abudhabityrerepair.com
birdpet.store
www6142.com
kingnat.xyz
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/532-167-0x0000000010410000-0x000000001043F000-memory.dmp formbook behavioral2/memory/4624-168-0x0000000000000000-mapping.dmp formbook behavioral2/memory/4624-193-0x0000000010410000-0x000000001043F000-memory.dmp formbook behavioral2/memory/4960-196-0x0000000000140000-0x000000000016F000-memory.dmp formbook behavioral2/memory/4960-200-0x0000000000140000-0x000000000016F000-memory.dmp formbook -
ModiLoader Second Stage 39 IoCs
Processes:
resource yara_rule behavioral2/memory/532-140-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-141-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-142-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-143-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-145-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-144-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-146-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-147-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-149-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-148-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-150-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-151-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-152-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-154-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-153-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-156-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-155-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-157-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-158-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-159-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-160-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-161-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-162-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-163-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-164-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-165-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-169-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-170-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-171-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-172-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-173-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-180-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-181-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-182-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-183-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-184-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-186-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-185-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 behavioral2/memory/532-187-0x0000000003D80000-0x0000000003DD5000-memory.dmp modiloader_stage2 -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 48 4960 msiexec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2feb4df65e22132bda72311108f6da24.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Naaykjraqd = "C:\\Users\\Public\\Libraries\\dqarjkyaaN.url" 2feb4df65e22132bda72311108f6da24.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
logagent.exemsiexec.exedescription pid process target process PID 4624 set thread context of 3132 4624 logagent.exe Explorer.EXE PID 4960 set thread context of 3132 4960 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
logagent.exemsiexec.exepid process 4624 logagent.exe 4624 logagent.exe 4624 logagent.exe 4624 logagent.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe 4960 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3132 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
logagent.exemsiexec.exepid process 4624 logagent.exe 4624 logagent.exe 4624 logagent.exe 4960 msiexec.exe 4960 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.exemsiexec.exedescription pid process Token: SeDebugPrivilege 4624 logagent.exe Token: SeDebugPrivilege 4960 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2feb4df65e22132bda72311108f6da24.exeExplorer.EXEmsiexec.exedescription pid process target process PID 532 wrote to memory of 4624 532 2feb4df65e22132bda72311108f6da24.exe logagent.exe PID 532 wrote to memory of 4624 532 2feb4df65e22132bda72311108f6da24.exe logagent.exe PID 532 wrote to memory of 4624 532 2feb4df65e22132bda72311108f6da24.exe logagent.exe PID 532 wrote to memory of 4624 532 2feb4df65e22132bda72311108f6da24.exe logagent.exe PID 532 wrote to memory of 4624 532 2feb4df65e22132bda72311108f6da24.exe logagent.exe PID 532 wrote to memory of 4624 532 2feb4df65e22132bda72311108f6da24.exe logagent.exe PID 3132 wrote to memory of 4960 3132 Explorer.EXE msiexec.exe PID 3132 wrote to memory of 4960 3132 Explorer.EXE msiexec.exe PID 3132 wrote to memory of 4960 3132 Explorer.EXE msiexec.exe PID 4960 wrote to memory of 4856 4960 msiexec.exe cmd.exe PID 4960 wrote to memory of 4856 4960 msiexec.exe cmd.exe PID 4960 wrote to memory of 4856 4960 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2feb4df65e22132bda72311108f6da24.exe"C:\Users\Admin\AppData\Local\Temp\2feb4df65e22132bda72311108f6da24.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-167-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/532-159-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-140-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-143-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-145-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-144-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-146-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-147-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-149-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-148-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-150-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-151-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-152-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-154-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-153-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-156-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-155-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-157-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-158-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-141-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-160-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-161-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-162-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-163-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-164-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-165-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-142-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-169-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-170-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-171-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-172-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-173-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-180-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-181-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-182-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-183-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-184-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-186-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-185-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/532-187-0x0000000003D80000-0x0000000003DD5000-memory.dmpFilesize
340KB
-
memory/3132-191-0x00000000083F0000-0x0000000008538000-memory.dmpFilesize
1.3MB
-
memory/3132-199-0x0000000002A70000-0x0000000002B6A000-memory.dmpFilesize
1000KB
-
memory/3132-201-0x0000000002A70000-0x0000000002B6A000-memory.dmpFilesize
1000KB
-
memory/4624-168-0x0000000000000000-mapping.dmp
-
memory/4624-189-0x0000000002940000-0x0000000002C8A000-memory.dmpFilesize
3.3MB
-
memory/4624-190-0x0000000002850000-0x0000000002865000-memory.dmpFilesize
84KB
-
memory/4624-193-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4856-194-0x0000000000000000-mapping.dmp
-
memory/4960-192-0x0000000000000000-mapping.dmp
-
memory/4960-195-0x0000000000270000-0x0000000000282000-memory.dmpFilesize
72KB
-
memory/4960-197-0x0000000002380000-0x00000000026CA000-memory.dmpFilesize
3.3MB
-
memory/4960-196-0x0000000000140000-0x000000000016F000-memory.dmpFilesize
188KB
-
memory/4960-198-0x0000000002120000-0x00000000021B4000-memory.dmpFilesize
592KB
-
memory/4960-200-0x0000000000140000-0x000000000016F000-memory.dmpFilesize
188KB