Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2023, 11:33

General

  • Target

    6.exe

  • Size

    816KB

  • MD5

    c913939da5213c631b70b06fa61eae28

  • SHA1

    28d2f9a5f12be6d61b85f5a5d6187e01f0ae284c

  • SHA256

    4b382c5497bb61b9cc4189101e9595a031f37db9fa712b61cdc4a60f59bff8b4

  • SHA512

    271be8d2ed70e93b16ae7a68e72b93252b6e9164f53d286014e371e801a268d650f484e1a19c1afd85abbd68c8f4718c11dc0c2c19ca64e849434d10fb476e49

  • SSDEEP

    12288:hvTirPykFC+EQpA7EOiidyVMmfP8DspvZFVphCF807ldv8gjwowEl52joHDL4wk:aPVFn/A7vsV/f6MvvV+maHN5RA

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euv4

Decoy

anniebapartments.com

hagenbicycles.com

herbalist101.com

southerncorrosion.net

kuechenpruefer.com

tajniezdrzi.quest

segurofunerarioar.com

boardsandbeamsdecor.com

alifdanismanlik.com

pkem.top

mddc.clinic

handejqr.com

crux-at.com

awp.email

hugsforbubbs.com

cielotherepy.com

turkcuyuz.com

teamidc.com

lankasirinspa.com

68135.online

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • ModiLoader Second Stage 1 IoCs
  • Xloader payload 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Users\Admin\AppData\Local\Temp\6.exe
      "C:\Users\Admin\AppData\Local\Temp\6.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Windows\SysWOW64\iexpress.exe
        C:\Windows\System32\iexpress.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3776
    • C:\Windows\SysWOW64\WWAHost.exe
      "C:\Windows\SysWOW64\WWAHost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\iexpress.exe"
        3⤵
          PID:1752

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1032-150-0x0000000008460000-0x00000000085BF000-memory.dmp

            Filesize

            1.4MB

          • memory/1032-148-0x0000000008460000-0x00000000085BF000-memory.dmp

            Filesize

            1.4MB

          • memory/1032-141-0x00000000028C0000-0x0000000002A53000-memory.dmp

            Filesize

            1.6MB

          • memory/3776-138-0x0000000010410000-0x0000000010439000-memory.dmp

            Filesize

            164KB

          • memory/3776-139-0x0000000003FC0000-0x000000000430A000-memory.dmp

            Filesize

            3.3MB

          • memory/3776-140-0x0000000003F70000-0x0000000003F81000-memory.dmp

            Filesize

            68KB

          • memory/4532-144-0x0000000000980000-0x0000000000A5C000-memory.dmp

            Filesize

            880KB

          • memory/4532-145-0x0000000001BC0000-0x0000000001F0A000-memory.dmp

            Filesize

            3.3MB

          • memory/4532-146-0x0000000001020000-0x0000000001049000-memory.dmp

            Filesize

            164KB

          • memory/4532-147-0x00000000018F0000-0x0000000001980000-memory.dmp

            Filesize

            576KB

          • memory/4532-149-0x0000000001020000-0x0000000001049000-memory.dmp

            Filesize

            164KB

          • memory/4920-132-0x0000000003050000-0x000000000307C000-memory.dmp

            Filesize

            176KB

          • memory/4920-136-0x0000000010410000-0x0000000010439000-memory.dmp

            Filesize

            164KB

          • memory/4920-135-0x0000000010410000-0x0000000010439000-memory.dmp

            Filesize

            164KB