Analysis
-
max time kernel
172s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 09:40
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Trojan-gen.31819.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.Trojan-gen.31819.exe
Resource
win10v2004-20221111-en
General
-
Target
SecuriteInfo.com.Win32.Trojan-gen.31819.exe
-
Size
733KB
-
MD5
f536ea8fb5b6586bb2ffc764cd52abff
-
SHA1
313804060f2511b8382d369a3949d5524c1adaef
-
SHA256
e539f80082f961c600e6ff2a21e969d0641aa787831259d3fdd772b28d469721
-
SHA512
873e0a7174be40db35f8e8f06fd7ffaf340128e7ee6ec09f691ca8857aac9b1f4c5d6cdb76841858ef4e52b2fa5a4a9a18588221567626fe1474b8b101cef8ea
-
SSDEEP
12288:i1qMhtVLzLypCggIh36+O9dvjpQVeri442qKk/RqIkr:WFhHzmQgn6+8T/r7PaqI
Malware Config
Extracted
formbook
nvp4
EiywrQNofDNveWY1IESoBA==
yqEWFGRfErX7ICQCwyQ+YeLXtaA=
Ers0rc50nbjso0jbdZTmBw==
XQxVP45+F5OZn3ZBTC7MLe1OF3G5c5uK9A==
RHh4uwtsttjzlxy+eW3+
W+xQshfnvmF5n5x2d+cEVdBNIkQRHRE=
FwlyiuXNX0+Trw==
euLn91on/7DeDe++zbQ4YeLXtaA=
td4cO8m3HDRWtl8p7Q==
ZrlyAAPqc3GXI5k=
OM0IisKOI78FJC/IuIxxAu5nRg==
d6A0QJ6PV+AOpyK+eW3+
+EgxFWUu3Ulatl8p7Q==
GC/stck1ILXn+cWZx7w8W6rPFmO6c5uK9A==
hhIiK4+CKEOfB4tr
mA1pyQ85ye8N
4xgWYcEpEoidv8eXKNncAQ==
L+hOVbe+IWyc8oVUclc=
J7EGaJ+L+wKLXUYg7w==
L5R/nfdgQdMHD+TUKw1Zo3Hb
E4z2kWG/vE6yt5E=
+efGEVp82EycSL2U4cpFU2an/aM5SDuF
6zA2kAqIdAQKkve6y7RjtRBf+i8Nvw==
VRqXzvXLVF+hS9arybBihGeOTaKP
PgKByBDCpL4cd9+yO52n/xZmQZeF
pMit5lre4GVyi3xcfywQY58=
F/vD9x4Oz0RWtl8p7Q==
hvZhvTgp/H7Lm2RNdl0=
h/xWhNLDOEpSZUTmIguoBA==
o8qw6kCdiDV4kn1FMZ6et06V+dCQZEmG
bgMOGYox8vMQ
YmFKj+ZWVRBcep49cl0=
Wox2hOnIRnGp3s2RMZ9Zo3Hb
eeTk5zCrpCpSyntTeF0=
FOA7J3NsxuomwEARYVLNU1TR
yuLXKrWb72SKrA==
K6T6LoiKKwZrHY5i
B8UkEkol7nBvrLeOjSwQY58=
GwvWc8gVAk6yt5E=
4IboPYD24Hqi5mxf+g==
L4XQI2A00QtXxxi+eW3+
doMqp/ZMkE6yt5E=
1ebXKoTs0GSYqMZZc1U=
CYnoUKIiG5vI4/HHLNXpCw==
P/FwuirU0FeJxseeKNncAQ==
N21GaMlCYhFbtl8p7Q==
KY95j+NDjk6yt5E=
C/rJL7ACO0yfB4tr
z6QDKYo85+nxAx+zmTgBLYY=
IPBjddXCgzlvd2Y/C3KaMomhUQ==
KNsyKXJjN+wYPi8OLgNZo3Hb
kht0meHAHPpzqQ==
Rm5BMnxa1/s/yxq2wSJcfpc=
+Tn9l2Ax8vMQ
rwkQV4ruG7v1/s+ZKNncAQ==
7+RhcuhVYBpggr5YZUw=
YRaX4klS4xWfB4tr
YIZ5wgZjYOsslloz9A==
+SAdmP/smDZ6oKF4GxNZo3Hb
mSIWBEa/uz9JSodz
PGc0UrsbRk1LwHVWOp+9CQ==
DnJQctQ5jE6yt5E=
gYmlw+nLOxtYl4k=
eRJtqhQDH3KQsg==
brainbookgroup.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1672-132-0x0000000002740000-0x000000000276B000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Win32.Trojan-gen.31819.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Iuigzwjd = "C:\\Users\\Public\\Libraries\\djwzgiuI.url" SecuriteInfo.com.Win32.Trojan-gen.31819.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
wscript.exeipconfig.exedescription pid process target process PID 1744 set thread context of 2184 1744 wscript.exe Explorer.EXE PID 3964 set thread context of 2184 3964 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3964 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
SecuriteInfo.com.Win32.Trojan-gen.31819.exewscript.exeipconfig.exepid process 1672 SecuriteInfo.com.Win32.Trojan-gen.31819.exe 1672 SecuriteInfo.com.Win32.Trojan-gen.31819.exe 1744 wscript.exe 1744 wscript.exe 1744 wscript.exe 1744 wscript.exe 1744 wscript.exe 1744 wscript.exe 1744 wscript.exe 1744 wscript.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe 3964 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
wscript.exeipconfig.exepid process 1744 wscript.exe 1744 wscript.exe 1744 wscript.exe 3964 ipconfig.exe 3964 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
wscript.exeExplorer.EXEipconfig.exedescription pid process Token: SeDebugPrivilege 1744 wscript.exe Token: SeShutdownPrivilege 2184 Explorer.EXE Token: SeCreatePagefilePrivilege 2184 Explorer.EXE Token: SeShutdownPrivilege 2184 Explorer.EXE Token: SeCreatePagefilePrivilege 2184 Explorer.EXE Token: SeDebugPrivilege 3964 ipconfig.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
SecuriteInfo.com.Win32.Trojan-gen.31819.exeExplorer.EXEdescription pid process target process PID 1672 wrote to memory of 1744 1672 SecuriteInfo.com.Win32.Trojan-gen.31819.exe wscript.exe PID 1672 wrote to memory of 1744 1672 SecuriteInfo.com.Win32.Trojan-gen.31819.exe wscript.exe PID 1672 wrote to memory of 1744 1672 SecuriteInfo.com.Win32.Trojan-gen.31819.exe wscript.exe PID 1672 wrote to memory of 1744 1672 SecuriteInfo.com.Win32.Trojan-gen.31819.exe wscript.exe PID 1672 wrote to memory of 1744 1672 SecuriteInfo.com.Win32.Trojan-gen.31819.exe wscript.exe PID 1672 wrote to memory of 1744 1672 SecuriteInfo.com.Win32.Trojan-gen.31819.exe wscript.exe PID 2184 wrote to memory of 3964 2184 Explorer.EXE ipconfig.exe PID 2184 wrote to memory of 3964 2184 Explorer.EXE ipconfig.exe PID 2184 wrote to memory of 3964 2184 Explorer.EXE ipconfig.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan-gen.31819.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan-gen.31819.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1672-136-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1672-132-0x0000000002740000-0x000000000276B000-memory.dmpFilesize
172KB
-
memory/1672-135-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1744-141-0x00000000037D0000-0x0000000003B1A000-memory.dmpFilesize
3.3MB
-
memory/1744-138-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1744-139-0x0000000010411000-0x000000001043F000-memory.dmpFilesize
184KB
-
memory/1744-149-0x0000000010411000-0x000000001043F000-memory.dmpFilesize
184KB
-
memory/1744-142-0x0000000010432000-0x0000000010434000-memory.dmpFilesize
8KB
-
memory/1744-143-0x0000000002300000-0x0000000002310000-memory.dmpFilesize
64KB
-
memory/1744-134-0x0000000000000000-mapping.dmp
-
memory/1744-148-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2184-144-0x0000000002E80000-0x0000000002F5E000-memory.dmpFilesize
888KB
-
memory/2184-154-0x00000000031D0000-0x00000000032FB000-memory.dmpFilesize
1.2MB
-
memory/2184-152-0x00000000031D0000-0x00000000032FB000-memory.dmpFilesize
1.2MB
-
memory/3964-145-0x0000000000000000-mapping.dmp
-
memory/3964-150-0x0000000001080000-0x00000000013CA000-memory.dmpFilesize
3.3MB
-
memory/3964-151-0x0000000000EB0000-0x0000000000F3F000-memory.dmpFilesize
572KB
-
memory/3964-147-0x00000000008B0000-0x00000000008DD000-memory.dmpFilesize
180KB
-
memory/3964-153-0x00000000008B0000-0x00000000008DD000-memory.dmpFilesize
180KB
-
memory/3964-146-0x0000000000D10000-0x0000000000D1B000-memory.dmpFilesize
44KB