Analysis
- max time kernel
147s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
12/11/2022, 17:53
General
- Target U prilogu faktura za kasnjenje.exe
- Size 909KB
- Sample221112-wgaehsgh69
- SHA256 bec4ef3573fb041d4a688c353f4682186f2bfe3918e9add4b9c5ceda5ec2627c
Malware Config
Extracted
-
xloader
-
2.5
-
euv4
-
anniebapartments.com
-
hagenbicycles.com
-
herbalist101.com
-
southerncorrosion.net
-
kuechenpruefer.com
-
tajniezdrzi.quest
-
segurofunerarioar.com
-
boardsandbeamsdecor.com
-
alifdanismanlik.com
-
pkem.top
-
mddc.clinic
-
handejqr.com
-
crux-at.com
-
awp.email
-
hugsforbubbs.com
-
cielotherepy.com
-
turkcuyuz.com
-
teamidc.com
-
lankasirinspa.com
-
68135.online
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Xloader
Xloader is a rebranded version of Formbook malware.
- ModiLoader Second Stage 63 IoCs
- Xloader payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\U prilogu faktura za kasnjenje.exe"C:\Users\Admin\AppData\Local\Temp\U prilogu faktura za kasnjenje.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/216-284-0x0000000010410000-0x0000000010439000-memory.dmp
memory/216-317-0x0000000004410000-0x000000000475A000-memory.dmp
memory/216-318-0x0000000004390000-0x00000000043A1000-memory.dmp
memory/216-320-0x0000000010410000-0x0000000010439000-memory.dmp
memory/3076-319-0x00000000082B0000-0x0000000008458000-memory.dmp
memory/4344-162-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-168-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-136-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-137-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-138-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-139-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-140-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-141-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-142-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-143-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-144-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-145-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-146-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-147-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-148-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-166-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-149-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-152-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-151-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-153-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-154-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-155-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-156-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-157-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-158-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-159-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-160-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-161-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-134-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-163-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-135-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-164-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-150-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-167-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-165-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-169-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-170-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-171-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-172-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-173-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-174-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-175-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-176-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-177-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-178-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-179-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-180-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-181-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-182-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-183-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-184-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-185-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-186-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-187-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-188-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-189-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-190-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-132-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-191-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-192-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-193-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-194-0x00000000021E0000-0x000000000220B000-memory.dmp
memory/4344-195-0x00000000021E0000-0x000000000220B000-memory.dmp