Overview

overview

10

Static

static

SecuriteIn...16.exe

windows7-x64

10

SecuriteIn...16.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2022 08:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.InjectorX-gen.32696.11916.exe

  • Size

    782KB

  • MD5

    a5e7d643822b4bec515727dcb5a81654

  • SHA1

    378be3dff71b0a5486758091c71149202e19e78b

  • SHA256

    dc35d3d87c8f062b000472a46ec166c5bf8f399f95c02717eab4ce542043afd7

  • SHA512

    f3f7db1e7d2d05c0ffb96f829b1cc93692dc8130175e67398a9626e475f0a6472641cc57417a7ad39df765bb5b350b408b99bb98fe9621f6c082cd3c091241af

  • SSDEEP

    12288:9mHYsrAQMj7JP2cAmYOKe2ncjOQZ0RDFHNFap4nruadYaeLw2Y:s4ZljB2tOUAOQZ0Z1Hap4nya6RxY

Score
10/10
formbookmodiloadernvp4persistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

nvp4

Decoy

EiywrQNofDNveWY1IESoBA==

yqEWFGRfErX7ICQCwyQ+YeLXtaA=

Ers0rc50nbjso0jbdZTmBw==

XQxVP45+F5OZn3ZBTC7MLe1OF3G5c5uK9A==

RHh4uwtsttjzlxy+eW3+

W+xQshfnvmF5n5x2d+cEVdBNIkQRHRE=

FwlyiuXNX0+Trw==

euLn91on/7DeDe++zbQ4YeLXtaA=

td4cO8m3HDRWtl8p7Q==

ZrlyAAPqc3GXI5k=

OM0IisKOI78FJC/IuIxxAu5nRg==

d6A0QJ6PV+AOpyK+eW3+

+EgxFWUu3Ulatl8p7Q==

GC/stck1ILXn+cWZx7w8W6rPFmO6c5uK9A==

hhIiK4+CKEOfB4tr

mA1pyQ85ye8N

4xgWYcEpEoidv8eXKNncAQ==

L+hOVbe+IWyc8oVUclc=

J7EGaJ+L+wKLXUYg7w==

L5R/nfdgQdMHD+TUKw1Zo3Hb

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.32696.11916.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.32696.11916.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Windows\SysWOW64\wscript.exe
        C:\Windows\System32\wscript.exe
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3500
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
        PID:2772

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2064-132-0x00000000022A0000-0x00000000022CB000-memory.dmp
      Filesize

      172KB

      Download
    • memory/2064-135-0x0000000010410000-0x000000001043F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/2064-136-0x0000000010410000-0x000000001043F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/2688-143-0x0000000008280000-0x00000000083C4000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/3500-134-0x0000000000000000-mapping.dmp
      Download
    • memory/3500-138-0x0000000010410000-0x000000001043F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/3500-139-0x0000000010411000-0x000000001043F000-memory.dmp
      Filesize

      184KB

      Download
    • memory/3500-140-0x0000000004350000-0x000000000469A000-memory.dmp
      Filesize

      3.3MB

      Download
    • memory/3500-141-0x0000000010432000-0x0000000010434000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3500-142-0x0000000004280000-0x0000000004290000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3500-144-0x0000000010410000-0x000000001043F000-memory.dmp
      Filesize

      188KB

      Download