Analysis
-
max time kernel
364s -
max time network
431s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
10-02-2023 00:22
Static task
static1
Behavioral task
behavioral1
Sample
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe
Resource
win10v2004-20221111-en
General
-
Target
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe
-
Size
768KB
-
MD5
60faea31bf224b220204dc167f1418f8
-
SHA1
7849870bd13daf80db63e11cc70b9082b427b60f
-
SHA256
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2
-
SHA512
5870abc4939556654b60e538bfea254d83f6263a53434dda1c71bf09844dc0b6e146c1d943f8faedc66ae6b55c8e89df228a46337806ba0bb445c8a2ee4a5944
-
SSDEEP
12288:Zlm8oGNXxAKz3SiHxTqlC9KVlLaS0tZIANC2qywKHzAcCcu98sDa:bxoqxAKrSiHhqlC9yOHWUqybzYT9FD
Malware Config
Extracted
formbook
nvp4
EiywrQNofDNveWY1IESoBA==
yqEWFGRfErX7ICQCwyQ+YeLXtaA=
Ers0rc50nbjso0jbdZTmBw==
XQxVP45+F5OZn3ZBTC7MLe1OF3G5c5uK9A==
RHh4uwtsttjzlxy+eW3+
W+xQshfnvmF5n5x2d+cEVdBNIkQRHRE=
FwlyiuXNX0+Trw==
euLn91on/7DeDe++zbQ4YeLXtaA=
td4cO8m3HDRWtl8p7Q==
ZrlyAAPqc3GXI5k=
OM0IisKOI78FJC/IuIxxAu5nRg==
d6A0QJ6PV+AOpyK+eW3+
+EgxFWUu3Ulatl8p7Q==
GC/stck1ILXn+cWZx7w8W6rPFmO6c5uK9A==
hhIiK4+CKEOfB4tr
mA1pyQ85ye8N
4xgWYcEpEoidv8eXKNncAQ==
L+hOVbe+IWyc8oVUclc=
J7EGaJ+L+wKLXUYg7w==
L5R/nfdgQdMHD+TUKw1Zo3Hb
E4z2kWG/vE6yt5E=
+efGEVp82EycSL2U4cpFU2an/aM5SDuF
6zA2kAqIdAQKkve6y7RjtRBf+i8Nvw==
VRqXzvXLVF+hS9arybBihGeOTaKP
PgKByBDCpL4cd9+yO52n/xZmQZeF
pMit5lre4GVyi3xcfywQY58=
F/vD9x4Oz0RWtl8p7Q==
hvZhvTgp/H7Lm2RNdl0=
h/xWhNLDOEpSZUTmIguoBA==
o8qw6kCdiDV4kn1FMZ6et06V+dCQZEmG
bgMOGYox8vMQ
YmFKj+ZWVRBcep49cl0=
Wox2hOnIRnGp3s2RMZ9Zo3Hb
eeTk5zCrpCpSyntTeF0=
FOA7J3NsxuomwEARYVLNU1TR
yuLXKrWb72SKrA==
K6T6LoiKKwZrHY5i
B8UkEkol7nBvrLeOjSwQY58=
GwvWc8gVAk6yt5E=
4IboPYD24Hqi5mxf+g==
L4XQI2A00QtXxxi+eW3+
doMqp/ZMkE6yt5E=
1ebXKoTs0GSYqMZZc1U=
CYnoUKIiG5vI4/HHLNXpCw==
P/FwuirU0FeJxseeKNncAQ==
N21GaMlCYhFbtl8p7Q==
KY95j+NDjk6yt5E=
C/rJL7ACO0yfB4tr
z6QDKYo85+nxAx+zmTgBLYY=
IPBjddXCgzlvd2Y/C3KaMomhUQ==
KNsyKXJjN+wYPi8OLgNZo3Hb
kht0meHAHPpzqQ==
Rm5BMnxa1/s/yxq2wSJcfpc=
+Tn9l2Ax8vMQ
rwkQV4ruG7v1/s+ZKNncAQ==
7+RhcuhVYBpggr5YZUw=
YRaX4klS4xWfB4tr
YIZ5wgZjYOsslloz9A==
+SAdmP/smDZ6oKF4GxNZo3Hb
mSIWBEa/uz9JSodz
PGc0UrsbRk1LwHVWOp+9CQ==
DnJQctQ5jE6yt5E=
gYmlw+nLOxtYl4k=
eRJtqhQDH3KQsg==
brainbookgroup.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4664-132-0x00000000022D0000-0x00000000022FB000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lyjefqkk = "C:\\Users\\Public\\Libraries\\kkqfejyL.url" 4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
colorcpl.execscript.exedescription pid process target process PID 4332 set thread context of 2728 4332 colorcpl.exe Explorer.EXE PID 4540 set thread context of 2728 4540 cscript.exe Explorer.EXE -
Processes:
cscript.exedescription ioc process Key created \Registry\User\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.execolorcpl.execscript.exepid process 4664 4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe 4664 4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe 4332 colorcpl.exe 4332 colorcpl.exe 4332 colorcpl.exe 4332 colorcpl.exe 4332 colorcpl.exe 4332 colorcpl.exe 4332 colorcpl.exe 4332 colorcpl.exe 4540 cscript.exe 4540 cscript.exe 4540 cscript.exe 4540 cscript.exe 4540 cscript.exe 4540 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
colorcpl.execscript.exepid process 4332 colorcpl.exe 4332 colorcpl.exe 4332 colorcpl.exe 4540 cscript.exe 4540 cscript.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
colorcpl.exeExplorer.EXEcscript.exedescription pid process Token: SeDebugPrivilege 4332 colorcpl.exe Token: SeShutdownPrivilege 2728 Explorer.EXE Token: SeCreatePagefilePrivilege 2728 Explorer.EXE Token: SeShutdownPrivilege 2728 Explorer.EXE Token: SeCreatePagefilePrivilege 2728 Explorer.EXE Token: SeDebugPrivilege 4540 cscript.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exeExplorer.EXEdescription pid process target process PID 4664 wrote to memory of 4332 4664 4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe colorcpl.exe PID 4664 wrote to memory of 4332 4664 4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe colorcpl.exe PID 4664 wrote to memory of 4332 4664 4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe colorcpl.exe PID 4664 wrote to memory of 4332 4664 4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe colorcpl.exe PID 4664 wrote to memory of 4332 4664 4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe colorcpl.exe PID 4664 wrote to memory of 4332 4664 4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe colorcpl.exe PID 2728 wrote to memory of 4540 2728 Explorer.EXE cscript.exe PID 2728 wrote to memory of 4540 2728 Explorer.EXE cscript.exe PID 2728 wrote to memory of 4540 2728 Explorer.EXE cscript.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe"C:\Users\Admin\AppData\Local\Temp\4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2728-149-0x0000000008C40000-0x0000000008D53000-memory.dmpFilesize
1.1MB
-
memory/2728-152-0x0000000003260000-0x000000000335D000-memory.dmpFilesize
1012KB
-
memory/2728-144-0x0000000008C40000-0x0000000008D53000-memory.dmpFilesize
1.1MB
-
memory/2728-153-0x0000000003260000-0x000000000335D000-memory.dmpFilesize
1012KB
-
memory/4332-142-0x0000000010432000-0x0000000010434000-memory.dmpFilesize
8KB
-
memory/4332-143-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4332-138-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4332-139-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4332-140-0x0000000010411000-0x000000001043F000-memory.dmpFilesize
184KB
-
memory/4332-134-0x0000000000000000-mapping.dmp
-
memory/4332-141-0x0000000004C10000-0x0000000004F5A000-memory.dmpFilesize
3.3MB
-
memory/4540-151-0x0000000002F90000-0x000000000301F000-memory.dmpFilesize
572KB
-
memory/4540-146-0x00000000002F0000-0x0000000000317000-memory.dmpFilesize
156KB
-
memory/4540-147-0x0000000001100000-0x000000000112D000-memory.dmpFilesize
180KB
-
memory/4540-148-0x0000000003200000-0x000000000354A000-memory.dmpFilesize
3.3MB
-
memory/4540-150-0x0000000001100000-0x000000000112D000-memory.dmpFilesize
180KB
-
memory/4540-145-0x0000000000000000-mapping.dmp
-
memory/4664-132-0x00000000022D0000-0x00000000022FB000-memory.dmpFilesize
172KB
-
memory/4664-136-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4664-135-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB