Analysis
-
max time kernel
134s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 09:27
Static task
static1
Behavioral task
behavioral1
Sample
8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe
Resource
win10v2004-20220901-en
General
-
Target
8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe
-
Size
610KB
-
MD5
8562b4db21d7ab120b4164026146663b
-
SHA1
825f06b14b5150c0b76398b01969bf13c27d09c9
-
SHA256
8bf0c3505263c0d5101750057d26a58377b6af83db9fad3ec45bd412c2121d7a
-
SHA512
bba264bed3f3927f15263bcb5a930aa08992b01c2ed92b2b4592e8ad55babd2fbd8e0b19df7953bb53b0554256705b0f64df89d1adf0aa7d4dbaff84b397fe5c
-
SSDEEP
12288:vBJ1YFRuFKa00Cl3MY5ygMiQOjgONQkS49tN0i/vO80Wynic9:vVER/0Cl3MYRnNQM9tN0kv8jl
Malware Config
Extracted
modiloader
https://cdn.discordapp.com/attachments/720370823554138118/753853112418041956/Wxhkvco
Extracted
netwire
fuckfuck0.ddns.net:3871
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-CeKkGs
-
keylogger_dir
C:\Users\Admin\AppData\Roaming\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4040-152-0x0000000000400000-0x0000000000434000-memory.dmp netwire -
ModiLoader First Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2448-133-0x0000000002270000-0x0000000002298000-memory.dmp modiloader_stage1 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wxhk = "C:\\Users\\Admin\\AppData\\Local\\Wxhk.url" 8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exedescription pid process target process PID 2448 set thread context of 4040 2448 8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe ieinstal.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exedescription pid process target process PID 2448 wrote to memory of 4040 2448 8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe ieinstal.exe PID 2448 wrote to memory of 4040 2448 8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe ieinstal.exe PID 2448 wrote to memory of 4040 2448 8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe ieinstal.exe PID 2448 wrote to memory of 4040 2448 8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe ieinstal.exe PID 2448 wrote to memory of 4040 2448 8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe"C:\Users\Admin\AppData\Local\Temp\8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2448-133-0x0000000002270000-0x0000000002298000-memory.dmpFilesize
160KB
-
memory/2448-140-0x0000000003470000-0x00000000034D4000-memory.dmpFilesize
400KB
-
memory/4040-147-0x0000000000000000-mapping.dmp
-
memory/4040-148-0x0000000000540000-0x0000000000576000-memory.dmpFilesize
216KB
-
memory/4040-150-0x0000000000540000-0x0000000000576000-memory.dmpFilesize
216KB
-
memory/4040-151-0x0000000000540000-0x0000000000576000-memory.dmpFilesize
216KB
-
memory/4040-152-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB