Analysis
-
max time kernel
132s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2022 06:27
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
PURCHASE.exe
Resource
win10v2004-20220721-en
General
-
Target
PURCHASE.exe
-
Size
626KB
-
MD5
a636e2bf0305939dd3ea280d58581d34
-
SHA1
6fc92b1d61667f4c9356973e65bf569244bbc001
-
SHA256
32107a42454e062900cfb8473bb035447a1cdd839fc1808902ab63a6c64988fe
-
SHA512
4157bedd94564aad54b118524727a6241b0d6ae58e911e4611ff87801183a12c23484424565b0dca5c738c13c0e1f7d97c77bae49ce8e23cbde4ded47dc071e6
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PURCHASE.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nxjctqqbv = "C:\\Users\\Public\\Libraries\\vbqqtcjxN.url" PURCHASE.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1512 1516 WerFault.exe PURCHASE.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3080 powershell.exe 3080 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3080 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PURCHASE.execmd.execmd.exenet.exedescription pid process target process PID 1516 wrote to memory of 2000 1516 PURCHASE.exe cmd.exe PID 1516 wrote to memory of 2000 1516 PURCHASE.exe cmd.exe PID 1516 wrote to memory of 2000 1516 PURCHASE.exe cmd.exe PID 2000 wrote to memory of 4840 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 4840 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 4840 2000 cmd.exe cmd.exe PID 4840 wrote to memory of 2392 4840 cmd.exe net.exe PID 4840 wrote to memory of 2392 4840 cmd.exe net.exe PID 4840 wrote to memory of 2392 4840 cmd.exe net.exe PID 2392 wrote to memory of 392 2392 net.exe net1.exe PID 2392 wrote to memory of 392 2392 net.exe net1.exe PID 2392 wrote to memory of 392 2392 net.exe net1.exe PID 4840 wrote to memory of 3080 4840 cmd.exe powershell.exe PID 4840 wrote to memory of 3080 4840 cmd.exe powershell.exe PID 4840 wrote to memory of 3080 4840 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\Nxjctqqbvt.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\NxjctqqbvO.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 15162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1516 -ip 15161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Libraries\Cdex.batFilesize
155B
MD5213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
-
C:\Users\Public\Libraries\NxjctqqbvO.batFilesize
1KB
MD5df48c09f243ebcc8a165f77a1c2bf889
SHA1455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA2564ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
SHA512735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
-
C:\Users\Public\Libraries\Nxjctqqbvt.batFilesize
58B
MD58d7ca5babda35dd26c8d5a9574368846
SHA117dbfca3da28f92024347b76f1e2e44526c9d462
SHA2569d6d886a6ae3f063d6454d48345afbd4d80f812bd02357b9f459b19b77325524
SHA512801ddbf140a5f1b5e5b6c38972f484408f54126016a39d9d30b657f5cb007c899ee571ff829b6334d843941324332755fb760d20e5e9b965b5ae4ca643b545a1
-
memory/392-139-0x0000000000000000-mapping.dmp
-
memory/2000-134-0x0000000000000000-mapping.dmp
-
memory/2392-138-0x0000000000000000-mapping.dmp
-
memory/3080-146-0x0000000005AB0000-0x0000000005B16000-memory.dmpFilesize
408KB
-
memory/3080-149-0x000000006F760000-0x000000006F7AC000-memory.dmpFilesize
304KB
-
memory/3080-142-0x0000000002C10000-0x0000000002C46000-memory.dmpFilesize
216KB
-
memory/3080-143-0x0000000005480000-0x0000000005AA8000-memory.dmpFilesize
6.2MB
-
memory/3080-144-0x0000000005250000-0x0000000005272000-memory.dmpFilesize
136KB
-
memory/3080-145-0x00000000053F0000-0x0000000005456000-memory.dmpFilesize
408KB
-
memory/3080-157-0x0000000007700000-0x0000000007708000-memory.dmpFilesize
32KB
-
memory/3080-147-0x00000000060F0000-0x000000000610E000-memory.dmpFilesize
120KB
-
memory/3080-148-0x00000000066B0000-0x00000000066E2000-memory.dmpFilesize
200KB
-
memory/3080-141-0x0000000000000000-mapping.dmp
-
memory/3080-150-0x0000000006690000-0x00000000066AE000-memory.dmpFilesize
120KB
-
memory/3080-151-0x0000000007AA0000-0x000000000811A000-memory.dmpFilesize
6.5MB
-
memory/3080-152-0x0000000007320000-0x000000000733A000-memory.dmpFilesize
104KB
-
memory/3080-153-0x0000000007460000-0x000000000746A000-memory.dmpFilesize
40KB
-
memory/3080-154-0x0000000007650000-0x00000000076E6000-memory.dmpFilesize
600KB
-
memory/3080-155-0x0000000007610000-0x000000000761E000-memory.dmpFilesize
56KB
-
memory/3080-156-0x0000000007720000-0x000000000773A000-memory.dmpFilesize
104KB
-
memory/4840-136-0x0000000000000000-mapping.dmp