Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 10:42
Static task
static1
Behavioral task
behavioral1
Sample
Wiobdcdesigrcz.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Wiobdcdesigrcz.exe
Resource
win10v2004-20220901-en
General
-
Target
Wiobdcdesigrcz.exe
-
Size
719KB
-
MD5
05f703e7a42a6c540c9d5c815eb17f88
-
SHA1
2fc5a59e412216cba76eb7fa122478bec8c2d125
-
SHA256
0fd7b17afcfaa921522141380792c3105ec20547c795a21c2eb0810c82e7e5e2
-
SHA512
8f7eca2be01bb273b7e18644b02d9358725baf3bd1d51919899226ac8e1a7b8050d018f0af72341eb4aa092150537f151f303513c92305d1dc44e5741bd1c6b0
-
SSDEEP
12288:HbAOmbLGin3WhvyX2GahiJ9//4BsEOeNOVOYPmMi0fq1r:HbPsLV3WhKX2GF///MsEfAVOKmMi0fM
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/632-132-0x00000000028C0000-0x00000000028EB000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Wiobdcdesigrcz.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wiobdcde = "C:\\Users\\Public\\Libraries\\edcdboiW.url" Wiobdcdesigrcz.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Wiobdcdesigrcz.exepid process 632 Wiobdcdesigrcz.exe 632 Wiobdcdesigrcz.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Wiobdcdesigrcz.exedescription pid process target process PID 632 wrote to memory of 3464 632 Wiobdcdesigrcz.exe colorcpl.exe PID 632 wrote to memory of 3464 632 Wiobdcdesigrcz.exe colorcpl.exe PID 632 wrote to memory of 3464 632 Wiobdcdesigrcz.exe colorcpl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wiobdcdesigrcz.exe"C:\Users\Admin\AppData\Local\Temp\Wiobdcdesigrcz.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-132-0x00000000028C0000-0x00000000028EB000-memory.dmpFilesize
172KB
-
memory/632-135-0x0000000030410000-0x000000003043F000-memory.dmpFilesize
188KB
-
memory/632-136-0x0000000030410000-0x000000003043F000-memory.dmpFilesize
188KB
-
memory/3464-134-0x0000000000000000-mapping.dmp