Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 12:09
Static task
static1
Behavioral task
behavioral1
Sample
9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe
Resource
win10v2004-20230220-en
General
-
Target
9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe
-
Size
1.1MB
-
MD5
ff1827a05d6334802873178c3d9459ca
-
SHA1
a8a5264d15aef1dd1c6e982b1eb163d1714ac74c
-
SHA256
9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731
-
SHA512
816740310737eaf6e40045b693eff0589fdd348caa885ca07fcae909134fab65b80aafe0fdf355ae72a1e892e6e14b51381b9405a937ca0bd8634fcdda5bd6ae
-
SSDEEP
12288:oX8lOqFSsZ40z3QjB2lr5fPx7Zh70WoQzV9hBoSFhAf1nAhglR:Q8ltFSQ3AB2zp7pcf1nAhglR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/528-134-0x0000000002B30000-0x0000000002B5C000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bjaykrsr = "C:\\Users\\Public\\Libraries\\rsrkyajB.url" 9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
iexpress.execolorcpl.exedescription pid process target process PID 1840 set thread context of 3184 1840 iexpress.exe Explorer.EXE PID 5048 set thread context of 3184 5048 colorcpl.exe Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3224 2796 WerFault.exe Firefox.exe -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exeiexpress.execolorcpl.exepid process 528 9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe 528 9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe 1840 iexpress.exe 1840 iexpress.exe 1840 iexpress.exe 1840 iexpress.exe 1840 iexpress.exe 1840 iexpress.exe 1840 iexpress.exe 1840 iexpress.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3184 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
iexpress.execolorcpl.exepid process 1840 iexpress.exe 1840 iexpress.exe 1840 iexpress.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe 5048 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
iexpress.exeExplorer.EXEcolorcpl.exedescription pid process Token: SeDebugPrivilege 1840 iexpress.exe Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeDebugPrivilege 5048 colorcpl.exe Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 528 wrote to memory of 1840 528 9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe iexpress.exe PID 528 wrote to memory of 1840 528 9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe iexpress.exe PID 528 wrote to memory of 1840 528 9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe iexpress.exe PID 528 wrote to memory of 1840 528 9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe iexpress.exe PID 528 wrote to memory of 1840 528 9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe iexpress.exe PID 528 wrote to memory of 1840 528 9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe iexpress.exe PID 3184 wrote to memory of 5048 3184 Explorer.EXE colorcpl.exe PID 3184 wrote to memory of 5048 3184 Explorer.EXE colorcpl.exe PID 3184 wrote to memory of 5048 3184 Explorer.EXE colorcpl.exe PID 5048 wrote to memory of 2796 5048 colorcpl.exe Firefox.exe PID 5048 wrote to memory of 2796 5048 colorcpl.exe Firefox.exe PID 5048 wrote to memory of 2796 5048 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe"C:\Users\Admin\AppData\Local\Temp\9e1b4f2d408e187ca641c0c16269069d0acabe5ae15514418726fbc720b33731.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iexpress.exeC:\Windows\System32\iexpress.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2796 -s 1204⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 2796 -ip 27961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/528-133-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/528-134-0x0000000002B30000-0x0000000002B5C000-memory.dmpFilesize
176KB
-
memory/528-136-0x0000000000400000-0x000000000052A000-memory.dmpFilesize
1.2MB
-
memory/528-147-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/528-148-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1840-149-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/1840-151-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1840-152-0x0000000003CA0000-0x0000000003FEA000-memory.dmpFilesize
3.3MB
-
memory/1840-153-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1840-154-0x0000000003B40000-0x0000000003B50000-memory.dmpFilesize
64KB
-
memory/3184-177-0x00000000023C0000-0x000000000270A000-memory.dmpFilesize
3.3MB
-
memory/3184-184-0x00000000023C0000-0x000000000270A000-memory.dmpFilesize
3.3MB
-
memory/3184-238-0x0000000007910000-0x000000000791A000-memory.dmpFilesize
40KB
-
memory/3184-237-0x0000000007910000-0x000000000791A000-memory.dmpFilesize
40KB
-
memory/3184-226-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-225-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-162-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-163-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-164-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-165-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-166-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-167-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-168-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-169-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-170-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-171-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-172-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-173-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-174-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-175-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-178-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-179-0x00000000023C0000-0x000000000270A000-memory.dmpFilesize
3.3MB
-
memory/3184-155-0x0000000002BE0000-0x0000000002CA3000-memory.dmpFilesize
780KB
-
memory/3184-176-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-180-0x0000000006F90000-0x0000000007048000-memory.dmpFilesize
736KB
-
memory/3184-224-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-183-0x00000000023C0000-0x000000000270A000-memory.dmpFilesize
3.3MB
-
memory/3184-223-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-186-0x0000000006F90000-0x0000000007048000-memory.dmpFilesize
736KB
-
memory/3184-196-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-197-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-198-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-199-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-200-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-201-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-202-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-203-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-204-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-205-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-206-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-207-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-208-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-209-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-210-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-211-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-213-0x0000000007910000-0x000000000791A000-memory.dmpFilesize
40KB
-
memory/3184-215-0x0000000007910000-0x000000000791A000-memory.dmpFilesize
40KB
-
memory/3184-221-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/3184-222-0x0000000002CB0000-0x0000000002CC0000-memory.dmpFilesize
64KB
-
memory/5048-157-0x00000000003D0000-0x00000000003E9000-memory.dmpFilesize
100KB
-
memory/5048-181-0x00000000020E0000-0x000000000216F000-memory.dmpFilesize
572KB
-
memory/5048-161-0x0000000000120000-0x000000000014D000-memory.dmpFilesize
180KB
-
memory/5048-160-0x00000000023C0000-0x000000000270A000-memory.dmpFilesize
3.3MB
-
memory/5048-159-0x0000000000120000-0x000000000014D000-memory.dmpFilesize
180KB
-
memory/5048-158-0x00000000003D0000-0x00000000003E9000-memory.dmpFilesize
100KB