Analysis

  • max time kernel
    75s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-09-2022 19:37

General

  • Target

    FCL CARDLOCK INVOICES - FORM L503.exe

  • Size

    1.0MB

  • MD5

    6048b7d63c1d99c4b6d1732fc6d941ae

  • SHA1

    524a1d0da58ad8bae9cf5f07a219985679013377

  • SHA256

    eddd07b69b4942f144f84ce2f03c6785b8c770a6f226c5d0f31c47bb147e7367

  • SHA512

    3bd9b413caef04df42984153b1151cd598023def6c9da9a77ddb05f90158e170314863fc40d366fbec5b0bb3b36cb72fff1be4b18be14af9d0df1fa103a6f629

  • SSDEEP

    24576:VkUwSu91iUJodQ/UbMV2i4rpNXeaqnjD:Vw9tyi4NXeaqnjD

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • NetWire RAT payload 2 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • ModiLoader Second Stage 63 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FCL CARDLOCK INVOICES - FORM L503.exe
    "C:\Users\Admin\AppData\Local\Temp\FCL CARDLOCK INVOICES - FORM L503.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\XlqnrvkdO.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4012
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        3⤵
          PID:3368
        • C:\Windows\SysWOW64\xcopy.exe
          xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y
          3⤵
          • Enumerates system info in registry
          PID:4892
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
          3⤵
            PID:2496
          • C:\Windows\SysWOW64\xcopy.exe
            xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y
            3⤵
            • Enumerates system info in registry
            PID:4136
          • C:\Windows\SysWOW64\xcopy.exe
            xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y
            3⤵
            • Enumerates system info in registry
            PID:4212
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
            3⤵
              PID:2728
            • C:\Windows \System32\easinvoker.exe
              "C:\Windows \System32\easinvoker.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3384
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1204
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1752
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 6
              3⤵
              • Runs ping.exe
              PID:2144
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe
            2⤵
              PID:3656
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 520
                3⤵
                • Program crash
                PID:4392
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3656 -ip 3656
            1⤵
              PID:4284

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Persistence

            Registry Run Keys / Startup Folder

            1
            T1060

            Defense Evasion

            Modify Registry

            1
            T1112

            Discovery

            Query Registry

            1
            T1012

            System Information Discovery

            1
            T1082

            Remote System Discovery

            1
            T1018

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Public\Libraries\KDECO.bat
              Filesize

              155B

              MD5

              213c60adf1c9ef88dc3c9b2d579959d2

              SHA1

              e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021

              SHA256

              37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e

              SHA512

              fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7

            • C:\Users\Public\Libraries\XlqnrvkdO.bat
              Filesize

              411B

              MD5

              55aba243e88f6a6813c117ffe1fa5979

              SHA1

              210b9b028a4b798c837a182321dbf2e50d112816

              SHA256

              5a11c5641c476891aa30e7ecfa57c2639f6827d8640061f73e9afec0adbbd7d2

              SHA512

              68009c4c9bbea75a3bfa9f79945d30957a95691ea405d031b4ca7f1cb47504bbc768fcae59173885743ad4d6cfdd2313c3fe0acb515e34e5c809ecdc7f45e307

            • C:\Users\Public\Libraries\easinvoker.exe
              Filesize

              128KB

              MD5

              231ce1e1d7d98b44371ffff407d68b59

              SHA1

              25510d0f6353dbf0c9f72fc880de7585e34b28ff

              SHA256

              30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

              SHA512

              520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

            • C:\Users\Public\Libraries\netutils.dll
              Filesize

              108KB

              MD5

              0511e36a6408d2197034ca03c7db9b02

              SHA1

              54cbb647c50076239eedd94aff3c8240eb0c4125

              SHA256

              35e4a45c3a3f42ef5d340e891e864bafc49e7e869c626bad456290c9cc888303

              SHA512

              613ba2bef07bd751aad3e21c18b6c02635fea2b02523908b61fc60aa48d8759bb9b138582e8e617555c49d9bead9fa4dfa6263f5f88f8249c89c82f136665e78

            • C:\Windows \System32\easinvoker.exe
              Filesize

              128KB

              MD5

              231ce1e1d7d98b44371ffff407d68b59

              SHA1

              25510d0f6353dbf0c9f72fc880de7585e34b28ff

              SHA256

              30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

              SHA512

              520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

            • C:\Windows \System32\easinvoker.exe
              Filesize

              128KB

              MD5

              231ce1e1d7d98b44371ffff407d68b59

              SHA1

              25510d0f6353dbf0c9f72fc880de7585e34b28ff

              SHA256

              30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

              SHA512

              520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

            • C:\Windows \System32\netutils.dll
              Filesize

              108KB

              MD5

              0511e36a6408d2197034ca03c7db9b02

              SHA1

              54cbb647c50076239eedd94aff3c8240eb0c4125

              SHA256

              35e4a45c3a3f42ef5d340e891e864bafc49e7e869c626bad456290c9cc888303

              SHA512

              613ba2bef07bd751aad3e21c18b6c02635fea2b02523908b61fc60aa48d8759bb9b138582e8e617555c49d9bead9fa4dfa6263f5f88f8249c89c82f136665e78

            • C:\Windows \System32\netutils.dll
              Filesize

              108KB

              MD5

              0511e36a6408d2197034ca03c7db9b02

              SHA1

              54cbb647c50076239eedd94aff3c8240eb0c4125

              SHA256

              35e4a45c3a3f42ef5d340e891e864bafc49e7e869c626bad456290c9cc888303

              SHA512

              613ba2bef07bd751aad3e21c18b6c02635fea2b02523908b61fc60aa48d8759bb9b138582e8e617555c49d9bead9fa4dfa6263f5f88f8249c89c82f136665e78

            • C:\windows \system32\KDECO.bat
              Filesize

              155B

              MD5

              213c60adf1c9ef88dc3c9b2d579959d2

              SHA1

              e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021

              SHA256

              37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e

              SHA512

              fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7

            • memory/1204-256-0x0000000000000000-mapping.dmp
            • memory/1752-260-0x000001B491510000-0x000001B491532000-memory.dmp
              Filesize

              136KB

            • memory/1752-259-0x0000000000000000-mapping.dmp
            • memory/1752-261-0x00007FFF778C0000-0x00007FFF78381000-memory.dmp
              Filesize

              10.8MB

            • memory/1752-262-0x00007FFF778C0000-0x00007FFF78381000-memory.dmp
              Filesize

              10.8MB

            • memory/2144-257-0x0000000000000000-mapping.dmp
            • memory/2496-245-0x0000000000000000-mapping.dmp
            • memory/2728-248-0x0000000000000000-mapping.dmp
            • memory/3368-242-0x0000000000000000-mapping.dmp
            • memory/3384-251-0x0000000000000000-mapping.dmp
            • memory/3656-371-0x00000000010D0000-0x0000000001115000-memory.dmp
              Filesize

              276KB

            • memory/3656-269-0x0000000000000000-mapping.dmp
            • memory/3656-369-0x0000000010560000-0x00000000105A8000-memory.dmp
              Filesize

              288KB

            • memory/4012-240-0x0000000000000000-mapping.dmp
            • memory/4136-246-0x0000000000000000-mapping.dmp
            • memory/4212-249-0x0000000000000000-mapping.dmp
            • memory/4892-243-0x0000000000000000-mapping.dmp
            • memory/4984-154-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-190-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-161-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-162-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-164-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-165-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-166-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-163-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-167-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-169-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-168-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-170-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-171-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-172-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-173-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-174-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-175-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-176-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-177-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-178-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-179-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-180-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-181-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-182-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-183-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-184-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-185-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-186-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-187-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-188-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-189-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-160-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-191-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-192-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-193-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-194-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-195-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-159-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-158-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-156-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-157-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-132-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-155-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-153-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-151-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-152-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-149-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-150-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-148-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-146-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-147-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-145-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-144-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-140-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-143-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-142-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-141-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-139-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-138-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-137-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-136-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-134-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB

            • memory/4984-135-0x00000000022E0000-0x000000000230A000-memory.dmp
              Filesize

              168KB