Analysis
-
max time kernel
300s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-03-2023 01:11
Static task
static1
Behavioral task
behavioral1
Sample
payload_.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
payload_.exe
Resource
win10v2004-20230220-en
General
-
Target
payload_.exe
-
Size
771KB
-
MD5
74616397d582ada42ad0913e031178aa
-
SHA1
d9c57844ec3aa52f32b85c500cc7de7aa887aef9
-
SHA256
d05605503be2c4b67bed2f64a05a842926d499ee377ff79f6464e1bd0d188386
-
SHA512
ba73436956c9719c2f513d4e00dd98f4de2060d0699ca76bb5860a20533e11a8753dd98cafe1f81ac6d27c76e0ec4e938f566c0588de72ca386172b09dd98263
-
SSDEEP
12288:Pr5Nxzs78p/cJCzQkgtr80XGjObPkOOPIiteSmF0Z/:PFvzs7bJWbgtopibPkOOXm0
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/832-134-0x0000000004110000-0x000000000413C000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
payload_.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kunkizdn = "C:\\Users\\Public\\Libraries\\ndziknuK.url" payload_.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
colorcpl.exesystray.exedescription pid process target process PID 3212 set thread context of 3180 3212 colorcpl.exe Explorer.EXE PID 1852 set thread context of 3180 1852 systray.exe Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2580 884 WerFault.exe Firefox.exe -
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
payload_.execolorcpl.exepid process 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 832 payload_.exe 3212 colorcpl.exe 3212 colorcpl.exe 3212 colorcpl.exe 3212 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3180 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
colorcpl.exesystray.exepid process 3212 colorcpl.exe 3212 colorcpl.exe 3212 colorcpl.exe 1852 systray.exe 1852 systray.exe 1852 systray.exe 1852 systray.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
colorcpl.exeExplorer.EXEsystray.exedescription pid process Token: SeDebugPrivilege 3212 colorcpl.exe Token: SeShutdownPrivilege 3180 Explorer.EXE Token: SeCreatePagefilePrivilege 3180 Explorer.EXE Token: SeShutdownPrivilege 3180 Explorer.EXE Token: SeCreatePagefilePrivilege 3180 Explorer.EXE Token: SeDebugPrivilege 1852 systray.exe Token: SeShutdownPrivilege 3180 Explorer.EXE Token: SeCreatePagefilePrivilege 3180 Explorer.EXE Token: SeShutdownPrivilege 3180 Explorer.EXE Token: SeCreatePagefilePrivilege 3180 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3180 Explorer.EXE 3180 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
payload_.exeExplorer.EXEsystray.exedescription pid process target process PID 832 wrote to memory of 3212 832 payload_.exe colorcpl.exe PID 832 wrote to memory of 3212 832 payload_.exe colorcpl.exe PID 832 wrote to memory of 3212 832 payload_.exe colorcpl.exe PID 832 wrote to memory of 3212 832 payload_.exe colorcpl.exe PID 832 wrote to memory of 3212 832 payload_.exe colorcpl.exe PID 832 wrote to memory of 3212 832 payload_.exe colorcpl.exe PID 3180 wrote to memory of 1852 3180 Explorer.EXE systray.exe PID 3180 wrote to memory of 1852 3180 Explorer.EXE systray.exe PID 3180 wrote to memory of 1852 3180 Explorer.EXE systray.exe PID 1852 wrote to memory of 884 1852 systray.exe Firefox.exe PID 1852 wrote to memory of 884 1852 systray.exe Firefox.exe PID 1852 wrote to memory of 884 1852 systray.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payload_.exe"C:\Users\Admin\AppData\Local\Temp\payload_.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 884 -s 1364⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 436 -p 884 -ip 8841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-133-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/832-134-0x0000000004110000-0x000000000413C000-memory.dmpFilesize
176KB
-
memory/832-136-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/832-147-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/832-148-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1852-163-0x0000000003030000-0x00000000030BF000-memory.dmpFilesize
572KB
-
memory/1852-158-0x0000000000D30000-0x0000000000D36000-memory.dmpFilesize
24KB
-
memory/1852-161-0x0000000003150000-0x000000000349A000-memory.dmpFilesize
3.3MB
-
memory/1852-156-0x0000000000D30000-0x0000000000D36000-memory.dmpFilesize
24KB
-
memory/1852-160-0x00000000012F0000-0x000000000131D000-memory.dmpFilesize
180KB
-
memory/3180-162-0x0000000006D30000-0x0000000006DF5000-memory.dmpFilesize
788KB
-
memory/3180-165-0x0000000006D30000-0x0000000006DF5000-memory.dmpFilesize
788KB
-
memory/3180-155-0x0000000006C20000-0x0000000006D2F000-memory.dmpFilesize
1.1MB
-
memory/3212-153-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3212-159-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3212-154-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/3212-152-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3212-151-0x00000000053E0000-0x000000000572A000-memory.dmpFilesize
3.3MB
-
memory/3212-149-0x0000000001660000-0x0000000001661000-memory.dmpFilesize
4KB