Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2023 05:07
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Advice/Payment_Advice (SECURED)/Payment_Advice - Copy.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Payment_Advice/Payment_Advice (SECURED)/Payment_Advice - Copy.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Payment_Advice/Payment_Advice (SECURED)/Payment_Advice.pdf
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Payment_Advice/Payment_Advice (SECURED)/Payment_Advice.pdf
Resource
win10v2004-20220812-en
General
-
Target
Payment_Advice/Payment_Advice (SECURED)/Payment_Advice - Copy.exe
-
Size
884KB
-
MD5
7e32d4a4c1bbc8a01a87d00cad0c6551
-
SHA1
1bfdf5697335531398f13300a912979dd146b99a
-
SHA256
caf42d835224609c61dcc1b6ddfcf517e47088e750ee67b16508c4fb2fdc5e6b
-
SHA512
88a42409399b4a6a03350d51181964a6922c16b83a17f7cd11bdd414fc72ad8d6078de5d4a5c866a7397b8c069a67839c34ea4125e97e1270898a8fb3b43da7c
-
SSDEEP
12288:Cb8A+lyMML0gN55kXFyqf0bGBvGoE3IhAf1nAhglR:C4ZzML0gN5WXFaK9GoEHf1nAhglR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5000-132-0x0000000000A30000-0x0000000000A5C000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Payment_Advice - Copy.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sbcbbvdn = "C:\\Users\\Public\\Libraries\\ndvbbcbS.url" Payment_Advice - Copy.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
iexpress.execontrol.exedescription pid process target process PID 4444 set thread context of 760 4444 iexpress.exe Explorer.EXE PID 3520 set thread context of 760 3520 control.exe Explorer.EXE -
Processes:
control.exedescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Payment_Advice - Copy.exeiexpress.execontrol.exepid process 5000 Payment_Advice - Copy.exe 5000 Payment_Advice - Copy.exe 4444 iexpress.exe 4444 iexpress.exe 4444 iexpress.exe 4444 iexpress.exe 4444 iexpress.exe 4444 iexpress.exe 4444 iexpress.exe 4444 iexpress.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 760 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
iexpress.execontrol.exepid process 4444 iexpress.exe 4444 iexpress.exe 4444 iexpress.exe 3520 control.exe 3520 control.exe 3520 control.exe 3520 control.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
iexpress.exeExplorer.EXEcontrol.exedescription pid process Token: SeDebugPrivilege 4444 iexpress.exe Token: SeShutdownPrivilege 760 Explorer.EXE Token: SeCreatePagefilePrivilege 760 Explorer.EXE Token: SeShutdownPrivilege 760 Explorer.EXE Token: SeCreatePagefilePrivilege 760 Explorer.EXE Token: SeDebugPrivilege 3520 control.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Payment_Advice - Copy.exeExplorer.EXEcontrol.exedescription pid process target process PID 5000 wrote to memory of 4444 5000 Payment_Advice - Copy.exe iexpress.exe PID 5000 wrote to memory of 4444 5000 Payment_Advice - Copy.exe iexpress.exe PID 5000 wrote to memory of 4444 5000 Payment_Advice - Copy.exe iexpress.exe PID 5000 wrote to memory of 4444 5000 Payment_Advice - Copy.exe iexpress.exe PID 5000 wrote to memory of 4444 5000 Payment_Advice - Copy.exe iexpress.exe PID 5000 wrote to memory of 4444 5000 Payment_Advice - Copy.exe iexpress.exe PID 760 wrote to memory of 3520 760 Explorer.EXE control.exe PID 760 wrote to memory of 3520 760 Explorer.EXE control.exe PID 760 wrote to memory of 3520 760 Explorer.EXE control.exe PID 3520 wrote to memory of 852 3520 control.exe Firefox.exe PID 3520 wrote to memory of 852 3520 control.exe Firefox.exe PID 3520 wrote to memory of 852 3520 control.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment_Advice\Payment_Advice (SECURED)\Payment_Advice - Copy.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Advice\Payment_Advice (SECURED)\Payment_Advice - Copy.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iexpress.exeC:\Windows\System32\iexpress.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-141-0x0000000002A90000-0x0000000002B4C000-memory.dmpFilesize
752KB
-
memory/760-149-0x0000000002C10000-0x0000000002CDB000-memory.dmpFilesize
812KB
-
memory/760-147-0x0000000002C10000-0x0000000002CDB000-memory.dmpFilesize
812KB
-
memory/3520-145-0x0000000002C90000-0x0000000002FDA000-memory.dmpFilesize
3.3MB
-
memory/3520-146-0x0000000002AC0000-0x0000000002B4F000-memory.dmpFilesize
572KB
-
memory/3520-148-0x0000000000B40000-0x0000000000B6D000-memory.dmpFilesize
180KB
-
memory/3520-143-0x00000000008C0000-0x00000000008E7000-memory.dmpFilesize
156KB
-
memory/3520-144-0x0000000000B40000-0x0000000000B6D000-memory.dmpFilesize
180KB
-
memory/3520-142-0x0000000000000000-mapping.dmp
-
memory/4444-140-0x0000000003BD0000-0x0000000003BE0000-memory.dmpFilesize
64KB
-
memory/4444-139-0x0000000003D30000-0x000000000407A000-memory.dmpFilesize
3.3MB
-
memory/4444-137-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4444-138-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4444-134-0x0000000000000000-mapping.dmp
-
memory/5000-136-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/5000-132-0x0000000000A30000-0x0000000000A5C000-memory.dmpFilesize
176KB
-
memory/5000-135-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB