Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2023, 09:36

General

  • Target

    U prilogu nova lista narudzbi.exe

  • Size

    740KB

  • MD5

    c03c09f867ffd16bb0af27e90d77d917

  • SHA1

    0db2adb82a5500ae122fe35986a76264715b5985

  • SHA256

    040a34e5884c29dd12452d342e344fe0d40f8dc1ea161d93c2a6c35b0a7da08b

  • SHA512

    9a0157b8ec6d4e45f38913dbbca8a951d24590e8831d731a39ddc7511c5833e5a77932c446641f4cff14e30801dd224904e3632c0fbdd842c24d2660e26ff9e7

  • SSDEEP

    12288:QJwpjlZUpP4dtZp1EgkuI1EXfVFxLBoOQziyMD78phts2O16a:QopZ9tT1wuI1EtLLxiiya78phm

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euv4

Decoy

anniebapartments.com

hagenbicycles.com

herbalist101.com

southerncorrosion.net

kuechenpruefer.com

tajniezdrzi.quest

segurofunerarioar.com

boardsandbeamsdecor.com

alifdanismanlik.com

pkem.top

mddc.clinic

handejqr.com

crux-at.com

awp.email

hugsforbubbs.com

cielotherepy.com

turkcuyuz.com

teamidc.com

lankasirinspa.com

68135.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • ModiLoader Second Stage 1 IoCs
  • Xloader payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\U prilogu nova lista narudzbi.exe
      "C:\Users\Admin\AppData\Local\Temp\U prilogu nova lista narudzbi.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\SysWOW64\iexpress.exe
        C:\Windows\System32\iexpress.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2676
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3348
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\iexpress.exe"
        3⤵
          PID:3468
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:4736
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:4688
          • C:\Program Files (x86)\Aut7pyh\kfrlo8tevh4.exe
            "C:\Program Files (x86)\Aut7pyh\kfrlo8tevh4.exe"
            2⤵
            • Executes dropped EXE
            PID:2224

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Aut7pyh\kfrlo8tevh4.exe

                Filesize

                148KB

                MD5

                d594b2a33efafd0eabf09e3fdc05fcea

                SHA1

                06845890c783abb305a8c9bbd119df5de0a17e6f

                SHA256

                dd2c185deae89d41f42fb9903aa274ae70b103ea2285184c4565f39b69df945f

                SHA512

                20e26f7ceb672a4b64cf05ca5595611b9fa561b6c141bd0e9fdc777836af1e343dffed81b07d8f3636d1e21a1fe42176c0a090dfb711eacd56006f85551e9a43

              • C:\Program Files (x86)\Aut7pyh\kfrlo8tevh4.exe

                Filesize

                148KB

                MD5

                d594b2a33efafd0eabf09e3fdc05fcea

                SHA1

                06845890c783abb305a8c9bbd119df5de0a17e6f

                SHA256

                dd2c185deae89d41f42fb9903aa274ae70b103ea2285184c4565f39b69df945f

                SHA512

                20e26f7ceb672a4b64cf05ca5595611b9fa561b6c141bd0e9fdc777836af1e343dffed81b07d8f3636d1e21a1fe42176c0a090dfb711eacd56006f85551e9a43

              • C:\Users\Admin\AppData\Local\Temp\DB1

                Filesize

                40KB

                MD5

                b608d407fc15adea97c26936bc6f03f6

                SHA1

                953e7420801c76393902c0d6bb56148947e41571

                SHA256

                b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                SHA512

                cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

              • memory/2676-142-0x0000000010410000-0x0000000010439000-memory.dmp

                Filesize

                164KB

              • memory/2676-138-0x0000000003C40000-0x0000000003F8A000-memory.dmp

                Filesize

                3.3MB

              • memory/2676-139-0x0000000003B90000-0x0000000003BA1000-memory.dmp

                Filesize

                68KB

              • memory/2688-156-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-183-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-223-0x0000000007B10000-0x0000000007B20000-memory.dmp

                Filesize

                64KB

              • memory/2688-222-0x0000000007B10000-0x0000000007B20000-memory.dmp

                Filesize

                64KB

              • memory/2688-221-0x0000000007B10000-0x0000000007B20000-memory.dmp

                Filesize

                64KB

              • memory/2688-147-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-148-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-149-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-150-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-151-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-152-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-153-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-154-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-155-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-220-0x0000000007B10000-0x0000000007B20000-memory.dmp

                Filesize

                64KB

              • memory/2688-158-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-157-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-160-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-159-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-161-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-163-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-164-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-165-0x0000000007B00000-0x0000000007B10000-memory.dmp

                Filesize

                64KB

              • memory/2688-166-0x0000000007B00000-0x0000000007B10000-memory.dmp

                Filesize

                64KB

              • memory/2688-219-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-168-0x0000000008230000-0x000000000830F000-memory.dmp

                Filesize

                892KB

              • memory/2688-218-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-170-0x0000000007B00000-0x0000000007B10000-memory.dmp

                Filesize

                64KB

              • memory/2688-171-0x0000000007B00000-0x0000000007B10000-memory.dmp

                Filesize

                64KB

              • memory/2688-172-0x0000000008230000-0x000000000830F000-memory.dmp

                Filesize

                892KB

              • memory/2688-173-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-174-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-175-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-176-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-177-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-178-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-179-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-180-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-181-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-182-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-217-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-184-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-185-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-186-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-187-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-188-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-189-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-190-0x00000000029F0000-0x0000000002A00000-memory.dmp

                Filesize

                64KB

              • memory/2688-191-0x0000000002A00000-0x0000000002A10000-memory.dmp

                Filesize

                64KB

              • memory/2688-192-0x0000000002A00000-0x0000000002A10000-memory.dmp

                Filesize

                64KB

              • memory/2688-193-0x0000000002A00000-0x0000000002A10000-memory.dmp

                Filesize

                64KB

              • memory/2688-194-0x00000000029F0000-0x0000000002A00000-memory.dmp

                Filesize

                64KB

              • memory/2688-195-0x0000000002A00000-0x0000000002A10000-memory.dmp

                Filesize

                64KB

              • memory/2688-196-0x0000000002A00000-0x0000000002A10000-memory.dmp

                Filesize

                64KB

              • memory/2688-197-0x0000000002A00000-0x0000000002A10000-memory.dmp

                Filesize

                64KB

              • memory/2688-216-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-140-0x0000000002EC0000-0x0000000002FEF000-memory.dmp

                Filesize

                1.2MB

              • memory/2688-215-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-213-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-214-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-203-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-204-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-205-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-206-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-207-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-208-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-209-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-210-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-211-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2688-212-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/3348-169-0x00000000003D0000-0x00000000003F9000-memory.dmp

                Filesize

                164KB

              • memory/3348-167-0x00000000025D0000-0x0000000002660000-memory.dmp

                Filesize

                576KB

              • memory/3348-146-0x00000000003D0000-0x00000000003F9000-memory.dmp

                Filesize

                164KB

              • memory/3348-145-0x0000000002790000-0x0000000002ADA000-memory.dmp

                Filesize

                3.3MB

              • memory/3348-144-0x00000000008E0000-0x0000000000907000-memory.dmp

                Filesize

                156KB

              • memory/4540-135-0x0000000010410000-0x0000000010439000-memory.dmp

                Filesize

                164KB

              • memory/4540-136-0x0000000010410000-0x0000000010439000-memory.dmp

                Filesize

                164KB

              • memory/4540-132-0x0000000002500000-0x000000000252C000-memory.dmp

                Filesize

                176KB