Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 10:04
Static task
static1
Behavioral task
behavioral1
Sample
6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe
Resource
win10v2004-20230220-en
General
-
Target
6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe
-
Size
720KB
-
MD5
e0ac8b5b2b3c5179b36a2363d60040bc
-
SHA1
872067726afe12a29e8dc90eac037fa90150ad0c
-
SHA256
6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0
-
SHA512
6cf2e874c5c13345674a808eb71816b987a0ca08f50fb1080f74d26a3081076ee159eb9a40f6da339461305bc8c984b3b629ce4437d7a4ac0c5640cfd5fd0436
-
SSDEEP
12288:MB171bq7pQn24yjmf0vff3kn6se2AtPFGu5Wwq5nCItvd9j:85E7pQ0yf+XlJtYu5Wwgn1d
Malware Config
Extracted
formbook
nvp4
EiywrQNofDNveWY1IESoBA==
yqEWFGRfErX7ICQCwyQ+YeLXtaA=
Ers0rc50nbjso0jbdZTmBw==
XQxVP45+F5OZn3ZBTC7MLe1OF3G5c5uK9A==
RHh4uwtsttjzlxy+eW3+
W+xQshfnvmF5n5x2d+cEVdBNIkQRHRE=
FwlyiuXNX0+Trw==
euLn91on/7DeDe++zbQ4YeLXtaA=
td4cO8m3HDRWtl8p7Q==
ZrlyAAPqc3GXI5k=
OM0IisKOI78FJC/IuIxxAu5nRg==
d6A0QJ6PV+AOpyK+eW3+
+EgxFWUu3Ulatl8p7Q==
GC/stck1ILXn+cWZx7w8W6rPFmO6c5uK9A==
hhIiK4+CKEOfB4tr
mA1pyQ85ye8N
4xgWYcEpEoidv8eXKNncAQ==
L+hOVbe+IWyc8oVUclc=
J7EGaJ+L+wKLXUYg7w==
L5R/nfdgQdMHD+TUKw1Zo3Hb
E4z2kWG/vE6yt5E=
+efGEVp82EycSL2U4cpFU2an/aM5SDuF
6zA2kAqIdAQKkve6y7RjtRBf+i8Nvw==
VRqXzvXLVF+hS9arybBihGeOTaKP
PgKByBDCpL4cd9+yO52n/xZmQZeF
pMit5lre4GVyi3xcfywQY58=
F/vD9x4Oz0RWtl8p7Q==
hvZhvTgp/H7Lm2RNdl0=
h/xWhNLDOEpSZUTmIguoBA==
o8qw6kCdiDV4kn1FMZ6et06V+dCQZEmG
bgMOGYox8vMQ
YmFKj+ZWVRBcep49cl0=
Wox2hOnIRnGp3s2RMZ9Zo3Hb
eeTk5zCrpCpSyntTeF0=
FOA7J3NsxuomwEARYVLNU1TR
yuLXKrWb72SKrA==
K6T6LoiKKwZrHY5i
B8UkEkol7nBvrLeOjSwQY58=
GwvWc8gVAk6yt5E=
4IboPYD24Hqi5mxf+g==
L4XQI2A00QtXxxi+eW3+
doMqp/ZMkE6yt5E=
1ebXKoTs0GSYqMZZc1U=
CYnoUKIiG5vI4/HHLNXpCw==
P/FwuirU0FeJxseeKNncAQ==
N21GaMlCYhFbtl8p7Q==
KY95j+NDjk6yt5E=
C/rJL7ACO0yfB4tr
z6QDKYo85+nxAx+zmTgBLYY=
IPBjddXCgzlvd2Y/C3KaMomhUQ==
KNsyKXJjN+wYPi8OLgNZo3Hb
kht0meHAHPpzqQ==
Rm5BMnxa1/s/yxq2wSJcfpc=
+Tn9l2Ax8vMQ
rwkQV4ruG7v1/s+ZKNncAQ==
7+RhcuhVYBpggr5YZUw=
YRaX4klS4xWfB4tr
YIZ5wgZjYOsslloz9A==
+SAdmP/smDZ6oKF4GxNZo3Hb
mSIWBEa/uz9JSodz
PGc0UrsbRk1LwHVWOp+9CQ==
DnJQctQ5jE6yt5E=
gYmlw+nLOxtYl4k=
eRJtqhQDH3KQsg==
brainbookgroup.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3168-133-0x00000000023F0000-0x000000000241C000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qcrtawbo = "C:\\Users\\Public\\Libraries\\obwatrcQ.url" 6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
colorcpl.exenetsh.exedescription pid process target process PID 3788 set thread context of 3172 3788 colorcpl.exe Explorer.EXE PID 4484 set thread context of 3172 4484 netsh.exe Explorer.EXE -
Processes:
netsh.exedescription ioc process Key created \Registry\User\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.execolorcpl.exenetsh.exepid process 3168 6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe 3168 6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe 3788 colorcpl.exe 3788 colorcpl.exe 3788 colorcpl.exe 3788 colorcpl.exe 3788 colorcpl.exe 3788 colorcpl.exe 3788 colorcpl.exe 3788 colorcpl.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3172 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
colorcpl.exenetsh.exepid process 3788 colorcpl.exe 3788 colorcpl.exe 3788 colorcpl.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe 4484 netsh.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
colorcpl.exeExplorer.EXEnetsh.exedescription pid process Token: SeDebugPrivilege 3788 colorcpl.exe Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeDebugPrivilege 4484 netsh.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exeExplorer.EXEnetsh.exedescription pid process target process PID 3168 wrote to memory of 3788 3168 6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe colorcpl.exe PID 3168 wrote to memory of 3788 3168 6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe colorcpl.exe PID 3168 wrote to memory of 3788 3168 6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe colorcpl.exe PID 3168 wrote to memory of 3788 3168 6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe colorcpl.exe PID 3168 wrote to memory of 3788 3168 6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe colorcpl.exe PID 3168 wrote to memory of 3788 3168 6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe colorcpl.exe PID 3172 wrote to memory of 4484 3172 Explorer.EXE netsh.exe PID 3172 wrote to memory of 4484 3172 Explorer.EXE netsh.exe PID 3172 wrote to memory of 4484 3172 Explorer.EXE netsh.exe PID 4484 wrote to memory of 4604 4484 netsh.exe Firefox.exe PID 4484 wrote to memory of 4604 4484 netsh.exe Firefox.exe PID 4484 wrote to memory of 4604 4484 netsh.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe"C:\Users\Admin\AppData\Local\Temp\6a726fb5c93adbae0f3061b40b19745587c0114deb86bd72c90acdd69242cbe0.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3168-148-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3168-135-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/3168-136-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/3168-147-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3168-133-0x00000000023F0000-0x000000000241C000-memory.dmpFilesize
176KB
-
memory/3172-156-0x0000000007E30000-0x0000000007F7F000-memory.dmpFilesize
1.3MB
-
memory/3172-166-0x0000000006D50000-0x0000000006DF8000-memory.dmpFilesize
672KB
-
memory/3172-170-0x0000000006D50000-0x0000000006DF8000-memory.dmpFilesize
672KB
-
memory/3172-167-0x0000000006D50000-0x0000000006DF8000-memory.dmpFilesize
672KB
-
memory/3788-153-0x0000000004A90000-0x0000000004DDA000-memory.dmpFilesize
3.3MB
-
memory/3788-154-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3788-155-0x00000000049E0000-0x00000000049F0000-memory.dmpFilesize
64KB
-
memory/3788-149-0x00000000046A0000-0x00000000046A1000-memory.dmpFilesize
4KB
-
memory/3788-152-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4484-160-0x00000000013E0000-0x00000000013FE000-memory.dmpFilesize
120KB
-
memory/4484-163-0x0000000000760000-0x000000000078D000-memory.dmpFilesize
180KB
-
memory/4484-165-0x0000000000E30000-0x0000000000EBF000-memory.dmpFilesize
572KB
-
memory/4484-162-0x0000000001000000-0x000000000134A000-memory.dmpFilesize
3.3MB
-
memory/4484-161-0x0000000000760000-0x000000000078D000-memory.dmpFilesize
180KB
-
memory/4484-157-0x00000000013E0000-0x00000000013FE000-memory.dmpFilesize
120KB