Analysis
-
max time kernel
78s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2022 06:07
Static task
static1
Behavioral task
behavioral1
Sample
Izjava u prilogu.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
Izjava u prilogu.exe
Resource
win10v2004-20220721-en
General
-
Target
Izjava u prilogu.exe
-
Size
836KB
-
MD5
07789017f254b6ac45b11f66ccada623
-
SHA1
6957e2bd7068f1303723c2ba3075771cdbcb23f0
-
SHA256
d17de6f437033140a8197c29721e535e19cde342b211c3a0074fa54f79afb375
-
SHA512
b30f98657c5069185af2e7a84af4bb2b2d73e9c7a455beae520668a6b40420e0f4d5f19333ec6f7ec45a74c8544f88d449ea1b8d2eacadf22e574b39a384e8b1
Malware Config
Extracted
remcos
RemoteHost
newehmpage.webredirect.org:5564
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
javaaa.exe
-
copy_folder
javaa
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
javaa-OMZZ5I
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
javaa
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 61 IoCs
Processes:
resource yara_rule behavioral2/memory/3264-148-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-161-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-162-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-163-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-164-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-165-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-166-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-167-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-168-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-169-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-170-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-171-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-172-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-173-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-174-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-175-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-176-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-177-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-178-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-179-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-180-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-181-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-182-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-183-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-184-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-185-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-186-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-187-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-188-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-189-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-190-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-191-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-192-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-193-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-194-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-195-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-197-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-196-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-198-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-199-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-200-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-201-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-202-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-203-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-204-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-210-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-211-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-212-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-213-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-215-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-217-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-219-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-220-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-222-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-224-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-225-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-226-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-227-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-228-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-229-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 behavioral2/memory/3264-230-0x0000000005020000-0x0000000005105000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Izjava u prilogu.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation Izjava u prilogu.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
Izjava u prilogu.execleanmgr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nwypnv = "C:\\Users\\Public\\Libraries\\vnpywN.url" Izjava u prilogu.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ cleanmgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaa = "\"C:\\ProgramData\\javaa\\javaaa.exe\"" cleanmgr.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ cleanmgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\javaa = "\"C:\\ProgramData\\javaa\\javaaa.exe\"" cleanmgr.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cleanmgr.exedescription ioc process File opened (read-only) \??\G: cleanmgr.exe File opened (read-only) \??\L: cleanmgr.exe File opened (read-only) \??\N: cleanmgr.exe File opened (read-only) \??\S: cleanmgr.exe File opened (read-only) \??\U: cleanmgr.exe File opened (read-only) \??\A: cleanmgr.exe File opened (read-only) \??\B: cleanmgr.exe File opened (read-only) \??\E: cleanmgr.exe File opened (read-only) \??\Y: cleanmgr.exe File opened (read-only) \??\R: cleanmgr.exe File opened (read-only) \??\T: cleanmgr.exe File opened (read-only) \??\I: cleanmgr.exe File opened (read-only) \??\O: cleanmgr.exe File opened (read-only) \??\Q: cleanmgr.exe File opened (read-only) \??\J: cleanmgr.exe File opened (read-only) \??\V: cleanmgr.exe File opened (read-only) \??\W: cleanmgr.exe File opened (read-only) \??\M: cleanmgr.exe File opened (read-only) \??\P: cleanmgr.exe File opened (read-only) \??\X: cleanmgr.exe File opened (read-only) \??\Z: cleanmgr.exe File opened (read-only) \??\F: cleanmgr.exe File opened (read-only) \??\H: cleanmgr.exe File opened (read-only) \??\K: cleanmgr.exe -
Drops file in System32 directory 4 IoCs
Processes:
cleanmgr.exedescription ioc process File opened for modification C:\Windows\system32\LogFiles\setupcln\setuperr.log cleanmgr.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagerr.xml cleanmgr.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagwrn.xml cleanmgr.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\setupact.log cleanmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
cleanmgr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000_Classes\Local Settings cleanmgr.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Izjava u prilogu.exepid process 3264 Izjava u prilogu.exe 3264 Izjava u prilogu.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Izjava u prilogu.execleanmgr.exedescription pid process target process PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 3264 wrote to memory of 552 3264 Izjava u prilogu.exe cleanmgr.exe PID 552 wrote to memory of 1384 552 cleanmgr.exe WScript.exe PID 552 wrote to memory of 1384 552 cleanmgr.exe WScript.exe PID 552 wrote to memory of 1384 552 cleanmgr.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Izjava u prilogu.exe"C:\Users\Admin\AppData\Local\Temp\Izjava u prilogu.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cleanmgr.exe"C:\Windows\System32\cleanmgr.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
484B
MD500ae292d95c92fc03ac0e8c075bf6508
SHA1378c52f9c2467345a51492efb3dcf6d89a370c80
SHA25647622b946aa321a0dbb0ccddbb004e8f690722d0ee36b696b8a4d266c0868f39
SHA512b73370de4d5e6df4e920ab7dd0a0bb77ac4b2ec26e6e17baa4fde9fc6796d999b4a36c38777264c2ed0bc3e9b5baed963b000308d9ec0cada5a0e0dc7baaa8c6
-
memory/552-205-0x0000000000000000-mapping.dmp
-
memory/552-221-0x0000000004930000-0x00000000049AE000-memory.dmpFilesize
504KB
-
memory/552-216-0x0000000004930000-0x00000000049AE000-memory.dmpFilesize
504KB
-
memory/552-214-0x0000000050600000-0x0000000050681000-memory.dmpFilesize
516KB
-
memory/1384-218-0x0000000000000000-mapping.dmp
-
memory/3264-189-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-226-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-191-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-164-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-193-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-166-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-167-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-168-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-169-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-170-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-171-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-172-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-173-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-174-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-175-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-176-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-177-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-178-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-179-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-180-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-181-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-182-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-183-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-184-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-185-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-186-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-187-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-188-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-161-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-190-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-163-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-162-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-165-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-194-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-195-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-197-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-196-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-198-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-199-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-200-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-201-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-202-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-203-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-204-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-207-0x0000000050600000-0x0000000050681000-memory.dmpFilesize
516KB
-
memory/3264-210-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-211-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-212-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-213-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-215-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-217-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-148-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-219-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-220-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-222-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-224-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-225-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-192-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-227-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-228-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-229-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB
-
memory/3264-230-0x0000000005020000-0x0000000005105000-memory.dmpFilesize
916KB