Analysis

  • max time kernel
    75s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2023, 13:17

General

  • Target

    U prilogu nova lista narudzbi.exe

  • Size

    740KB

  • MD5

    c03c09f867ffd16bb0af27e90d77d917

  • SHA1

    0db2adb82a5500ae122fe35986a76264715b5985

  • SHA256

    040a34e5884c29dd12452d342e344fe0d40f8dc1ea161d93c2a6c35b0a7da08b

  • SHA512

    9a0157b8ec6d4e45f38913dbbca8a951d24590e8831d731a39ddc7511c5833e5a77932c446641f4cff14e30801dd224904e3632c0fbdd842c24d2660e26ff9e7

  • SSDEEP

    12288:QJwpjlZUpP4dtZp1EgkuI1EXfVFxLBoOQziyMD78phts2O16a:QopZ9tT1wuI1EtLLxiiya78phm

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euv4

Decoy

anniebapartments.com

hagenbicycles.com

herbalist101.com

southerncorrosion.net

kuechenpruefer.com

tajniezdrzi.quest

segurofunerarioar.com

boardsandbeamsdecor.com

alifdanismanlik.com

pkem.top

mddc.clinic

handejqr.com

crux-at.com

awp.email

hugsforbubbs.com

cielotherepy.com

turkcuyuz.com

teamidc.com

lankasirinspa.com

68135.online

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • ModiLoader Second Stage 1 IoCs
  • Xloader payload 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\U prilogu nova lista narudzbi.exe
    "C:\Users\Admin\AppData\Local\Temp\U prilogu nova lista narudzbi.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Windows\SysWOW64\colorcpl.exe
      C:\Windows\System32\colorcpl.exe
      2⤵
        PID:4992

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4272-132-0x0000000002580000-0x00000000025AC000-memory.dmp

            Filesize

            176KB

          • memory/4272-135-0x0000000030410000-0x0000000030439000-memory.dmp

            Filesize

            164KB

          • memory/4272-136-0x0000000030410000-0x0000000030439000-memory.dmp

            Filesize

            164KB