Analysis
-
max time kernel
174s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 19:44
Static task
static1
Behavioral task
behavioral1
Sample
era 1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
era 1.exe
Resource
win10v2004-20221111-en
General
-
Target
era 1.exe
-
Size
862KB
-
MD5
84bf18cdc14d7e2c5311ff6cd071a0dc
-
SHA1
a784ef5651e7e1530d4e77ab9f7f3507b51d9e67
-
SHA256
f53107b892a50e33ff130e01cf391a2b69524dbe09b75cc13192365bbd6eda11
-
SHA512
97434045c4c0c4d82296c668ec01a8ae31a9eee9bfba7db6f2d314f1574d3ee950b6a7566a0faa313a1e396541dff76be4cedac8d96bd342ed8783d1f7dc4c0d
-
SSDEEP
12288:fSj5lclcaywFMtTPWQOQSJU3FtJlpCBIUQZC8fRuHT6Kk/RqIkr:fSVKFp6rfn/VXPCyE8fMuqI
Malware Config
Extracted
bitrat
1.38
winery.nsupdate.info:5877
-
communication_password
e5ff7c52fb3501484ea7ca8641803415
-
tor_process
tor
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1456-132-0x0000000002470000-0x000000000249B000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule behavioral2/memory/1456-135-0x0000000010410000-0x00000000107F4000-memory.dmp upx behavioral2/memory/1456-136-0x0000000010410000-0x00000000107F4000-memory.dmp upx behavioral2/memory/4548-138-0x0000000010410000-0x00000000107F4000-memory.dmp upx behavioral2/memory/4548-139-0x0000000010410000-0x00000000107F4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
era 1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kqrihjva = "C:\\Users\\Public\\Libraries\\avjhirqK.url" era 1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
colorcpl.exepid process 4548 colorcpl.exe 4548 colorcpl.exe 4548 colorcpl.exe 4548 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
era 1.exepid process 1456 era 1.exe 1456 era 1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
colorcpl.exedescription pid process Token: SeShutdownPrivilege 4548 colorcpl.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
colorcpl.exepid process 4548 colorcpl.exe 4548 colorcpl.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
era 1.exedescription pid process target process PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe PID 1456 wrote to memory of 4548 1456 era 1.exe colorcpl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\era 1.exe"C:\Users\Admin\AppData\Local\Temp\era 1.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1456-132-0x0000000002470000-0x000000000249B000-memory.dmpFilesize
172KB
-
memory/1456-135-0x0000000010410000-0x00000000107F4000-memory.dmpFilesize
3.9MB
-
memory/1456-136-0x0000000010410000-0x00000000107F4000-memory.dmpFilesize
3.9MB
-
memory/4548-134-0x0000000000000000-mapping.dmp
-
memory/4548-138-0x0000000010410000-0x00000000107F4000-memory.dmpFilesize
3.9MB
-
memory/4548-139-0x0000000010410000-0x00000000107F4000-memory.dmpFilesize
3.9MB
-
memory/4548-140-0x0000000074340000-0x0000000074379000-memory.dmpFilesize
228KB