Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-02-2023 15:38

General

  • Target

    Pdygfcjfevthba.exe

  • Size

    884KB

  • MD5

    054d3ce0c0c82f28547112a82f8ea692

  • SHA1

    8c088a60d8f7e66261cca8d4ccb384ea1d9ad2c4

  • SHA256

    591ea8c06daef587f239bbaa3d29cb46ccba25ccba58c324441efbaf4c5eb5d8

  • SHA512

    45978b98a401d90be5c0db269fb52abc11a185b2a0e68eafa1d4b6ecf830944b53d6d166fd8bee5b28088d48c2b521ad3968f4569025817fd67a88967c87aeab

  • SSDEEP

    12288:Cb8A+lyMML0gN55kXFyqf0bGBvGoE3IhAf1nAhglR:C4ZzML0gN5WXFaK9GoEHf1nAhglR

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\Pdygfcjfevthba.exe
      "C:\Users\Admin\AppData\Local\Temp\Pdygfcjfevthba.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\SysWOW64\iexpress.exe
        C:\Windows\System32\iexpress.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4004
    • C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\SysWOW64\cmstp.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:2000
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 2000 -s 184
            4⤵
            • Program crash
            PID:1600
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 444 -p 2000 -ip 2000
      1⤵
        PID:1828

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/404-142-0x0000000000000000-mapping.dmp

      • memory/404-147-0x0000000001090000-0x000000000111F000-memory.dmp

        Filesize

        572KB

      • memory/404-146-0x0000000002C60000-0x0000000002FAA000-memory.dmp

        Filesize

        3.3MB

      • memory/404-145-0x0000000000920000-0x000000000094D000-memory.dmp

        Filesize

        180KB

      • memory/404-144-0x0000000000DD0000-0x0000000000DE6000-memory.dmp

        Filesize

        88KB

      • memory/2204-141-0x0000000003280000-0x0000000003383000-memory.dmp

        Filesize

        1.0MB

      • memory/2204-148-0x0000000003390000-0x0000000003426000-memory.dmp

        Filesize

        600KB

      • memory/2204-149-0x0000000003390000-0x0000000003426000-memory.dmp

        Filesize

        600KB

      • memory/2860-132-0x0000000000780000-0x00000000007AC000-memory.dmp

        Filesize

        176KB

      • memory/2860-136-0x0000000010410000-0x000000001043F000-memory.dmp

        Filesize

        188KB

      • memory/2860-135-0x0000000010410000-0x000000001043F000-memory.dmp

        Filesize

        188KB

      • memory/4004-139-0x0000000003490000-0x00000000037DA000-memory.dmp

        Filesize

        3.3MB

      • memory/4004-140-0x0000000002210000-0x0000000002220000-memory.dmp

        Filesize

        64KB

      • memory/4004-138-0x0000000010410000-0x000000001043F000-memory.dmp

        Filesize

        188KB

      • memory/4004-143-0x0000000010410000-0x000000001043F000-memory.dmp

        Filesize

        188KB

      • memory/4004-137-0x0000000010410000-0x000000001043F000-memory.dmp

        Filesize

        188KB

      • memory/4004-134-0x0000000000000000-mapping.dmp