Analysis
- max time kernel
65s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
24/10/2022, 13:31
General
- Target FAKTURA.exe
- Size 770KB
- Sample221024-qsdcnahabm
- SHA256 6894716ecdc2dc8c9df8522345f04945c0d90df9c2b5426c72fb4eee7d809c79
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- ModiLoader Second Stage 63 IoCs
- Warzone RAT payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FAKTURA.exe"C:\Users\Admin\AppData\Local\Temp\FAKTURA.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/532-324-0x0000000010680000-0x00000000107EA000-memory.dmp
memory/532-325-0x0000000000400000-0x0000000000568000-memory.dmp
memory/532-326-0x000000000CCD0000-0x000000000CE70000-memory.dmp
memory/532-327-0x0000000000400000-0x0000000000568000-memory.dmp
memory/4328-162-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-167-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-135-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-136-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-137-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-138-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-139-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-140-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-141-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-142-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-143-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-144-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-145-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-146-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-147-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-165-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-148-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-151-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-150-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-152-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-153-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-154-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-155-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-156-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-157-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-158-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-159-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-160-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-161-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-132-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-134-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-163-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-149-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-166-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-164-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-168-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-169-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-170-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-171-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-172-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-173-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-174-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-175-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-176-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-177-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-178-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-179-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-180-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-181-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-182-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-183-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-184-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-185-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-186-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-187-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-188-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-189-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-190-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-191-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-192-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-193-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-194-0x00000000023F0000-0x000000000241B000-memory.dmp
memory/4328-195-0x00000000023F0000-0x000000000241B000-memory.dmp