Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2022 09:54

General

  • Target

    Novi poredak.exe

  • Size

    742KB

  • MD5

    c71ad16cf41fe33191e7aed3ff094cb5

  • SHA1

    2530410a028d56fe76cd4883ad6143c65110dfa3

  • SHA256

    c65eb86aa24a5f4ded6ad0fadfb7bb2eb6e6543a4a146f1dd05ae88bb7354375

  • SHA512

    c25844433fe78448977f689fd4afd070316c9e1c3544dd24a444d3efb193e183a063b834f3c045f27fe919c24b1d919dc6fc19229a1a2fa49a89949308f568ec

  • SSDEEP

    12288:X1vdLGEt9CUvF8rhmJ9pKOBEffIll6A4qFEPnjDZ46pbZe:lFBt9CUd8rhmJ9rOfehF6njDlpbZe

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euv4

Decoy

anniebapartments.com

hagenbicycles.com

herbalist101.com

southerncorrosion.net

kuechenpruefer.com

tajniezdrzi.quest

segurofunerarioar.com

boardsandbeamsdecor.com

alifdanismanlik.com

pkem.top

mddc.clinic

handejqr.com

crux-at.com

awp.email

hugsforbubbs.com

cielotherepy.com

turkcuyuz.com

teamidc.com

lankasirinspa.com

68135.online

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • ModiLoader Second Stage 63 IoCs
  • Xloader payload 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Users\Admin\AppData\Local\Temp\Novi poredak.exe
      "C:\Users\Admin\AppData\Local\Temp\Novi poredak.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:508
      • C:\Windows\SysWOW64\colorcpl.exe
        C:\Windows\System32\colorcpl.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3316
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\colorcpl.exe"
        3⤵
          PID:1220

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/508-172-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-164-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-137-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-136-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-134-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-139-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-140-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-141-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-138-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-142-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-143-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-144-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-145-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-146-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-147-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-148-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-149-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-150-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-151-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-153-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-154-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-155-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-152-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-156-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-157-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-158-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-159-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-161-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-162-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-132-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-160-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-165-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-166-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-167-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-171-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-169-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-170-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-168-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-163-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-173-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-135-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-174-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-175-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-176-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-177-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-178-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-179-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-180-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-181-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-182-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-183-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-184-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-185-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-186-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-187-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-188-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-189-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-190-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-191-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-192-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-193-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-195-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/508-194-0x0000000002280000-0x00000000022AA000-memory.dmp
      Filesize

      168KB

    • memory/760-314-0x0000000007E40000-0x0000000007F4A000-memory.dmp
      Filesize

      1.0MB

    • memory/760-338-0x00000000080A0000-0x00000000081A3000-memory.dmp
      Filesize

      1.0MB

    • memory/760-336-0x00000000080A0000-0x00000000081A3000-memory.dmp
      Filesize

      1.0MB

    • memory/1152-334-0x0000000000E00000-0x000000000114A000-memory.dmp
      Filesize

      3.3MB

    • memory/1152-332-0x0000000000130000-0x0000000000159000-memory.dmp
      Filesize

      164KB

    • memory/1152-335-0x0000000000C90000-0x0000000000D20000-memory.dmp
      Filesize

      576KB

    • memory/1152-331-0x0000000000450000-0x000000000045E000-memory.dmp
      Filesize

      56KB

    • memory/1152-337-0x0000000000130000-0x0000000000159000-memory.dmp
      Filesize

      164KB

    • memory/1152-329-0x0000000000000000-mapping.dmp
    • memory/1220-333-0x0000000000000000-mapping.dmp
    • memory/3316-309-0x0000000010410000-0x0000000010439000-memory.dmp
      Filesize

      164KB

    • memory/3316-251-0x0000000000000000-mapping.dmp
    • memory/3316-312-0x0000000005660000-0x00000000059AA000-memory.dmp
      Filesize

      3.3MB

    • memory/3316-328-0x0000000005590000-0x00000000055A1000-memory.dmp
      Filesize

      68KB

    • memory/3316-330-0x0000000010410000-0x0000000010439000-memory.dmp
      Filesize

      164KB