Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 16:27
Static task
static1
Behavioral task
behavioral1
Sample
Swift, unicredit bank.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Swift, unicredit bank.exe
Resource
win10v2004-20230220-en
General
-
Target
Swift, unicredit bank.exe
-
Size
665KB
-
MD5
67a09ce3a6ac852a8d493d41ac68231c
-
SHA1
0a4feb27fbf7af7465ffd3579cf79932ae64af61
-
SHA256
1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d
-
SHA512
02b2265c9c6c79569892f5f09b8d8c11e8dd6f287e4910927e4ee3891078acdf07437acdd9764ab59bb908731ab97b58eaccbff88dbc4f8da779009f0dd5e156
-
SSDEEP
12288:7xsnwyGGFm7NjhBBBHS4PKZr7j65hhxqeIpqOZODCFwxK:7yw0m5jhBBc4yZr7shCBiCix
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3036-133-0x00000000024E0000-0x000000000250C000-memory.dmp modiloader_stage2 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Swift, unicredit bank.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tcytakyi = "C:\\Users\\Public\\Libraries\\iykatycT.url" Swift, unicredit bank.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
colorcpl.execmstp.exedescription pid process target process PID 2876 set thread context of 1040 2876 colorcpl.exe Explorer.EXE PID 1372 set thread context of 1040 1372 cmstp.exe Explorer.EXE -
Processes:
cmstp.exedescription ioc process Key created \Registry\User\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
Swift, unicredit bank.execolorcpl.execmstp.exepid process 3036 Swift, unicredit bank.exe 3036 Swift, unicredit bank.exe 2876 colorcpl.exe 2876 colorcpl.exe 2876 colorcpl.exe 2876 colorcpl.exe 2876 colorcpl.exe 2876 colorcpl.exe 2876 colorcpl.exe 2876 colorcpl.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1040 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
colorcpl.execmstp.exepid process 2876 colorcpl.exe 2876 colorcpl.exe 2876 colorcpl.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe 1372 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
colorcpl.exeExplorer.EXEcmstp.exedescription pid process Token: SeDebugPrivilege 2876 colorcpl.exe Token: SeShutdownPrivilege 1040 Explorer.EXE Token: SeCreatePagefilePrivilege 1040 Explorer.EXE Token: SeShutdownPrivilege 1040 Explorer.EXE Token: SeCreatePagefilePrivilege 1040 Explorer.EXE Token: SeDebugPrivilege 1372 cmstp.exe Token: SeShutdownPrivilege 1040 Explorer.EXE Token: SeCreatePagefilePrivilege 1040 Explorer.EXE Token: SeShutdownPrivilege 1040 Explorer.EXE Token: SeCreatePagefilePrivilege 1040 Explorer.EXE Token: SeShutdownPrivilege 1040 Explorer.EXE Token: SeCreatePagefilePrivilege 1040 Explorer.EXE Token: SeShutdownPrivilege 1040 Explorer.EXE Token: SeCreatePagefilePrivilege 1040 Explorer.EXE Token: SeShutdownPrivilege 1040 Explorer.EXE Token: SeCreatePagefilePrivilege 1040 Explorer.EXE Token: SeShutdownPrivilege 1040 Explorer.EXE Token: SeCreatePagefilePrivilege 1040 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Swift, unicredit bank.exeExplorer.EXEcmstp.exedescription pid process target process PID 3036 wrote to memory of 2876 3036 Swift, unicredit bank.exe colorcpl.exe PID 3036 wrote to memory of 2876 3036 Swift, unicredit bank.exe colorcpl.exe PID 3036 wrote to memory of 2876 3036 Swift, unicredit bank.exe colorcpl.exe PID 3036 wrote to memory of 2876 3036 Swift, unicredit bank.exe colorcpl.exe PID 3036 wrote to memory of 2876 3036 Swift, unicredit bank.exe colorcpl.exe PID 3036 wrote to memory of 2876 3036 Swift, unicredit bank.exe colorcpl.exe PID 1040 wrote to memory of 1372 1040 Explorer.EXE cmstp.exe PID 1040 wrote to memory of 1372 1040 Explorer.EXE cmstp.exe PID 1040 wrote to memory of 1372 1040 Explorer.EXE cmstp.exe PID 1372 wrote to memory of 4104 1372 cmstp.exe Firefox.exe PID 1372 wrote to memory of 4104 1372 cmstp.exe Firefox.exe PID 1372 wrote to memory of 4104 1372 cmstp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift, unicredit bank.exe"C:\Users\Admin\AppData\Local\Temp\Swift, unicredit bank.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1040-179-0x0000000007460000-0x0000000007470000-memory.dmpFilesize
64KB
-
memory/1040-223-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-225-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-226-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-176-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-224-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-177-0x0000000002A50000-0x0000000002A60000-memory.dmpFilesize
64KB
-
memory/1040-222-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-216-0x0000000002980000-0x0000000002990000-memory.dmpFilesize
64KB
-
memory/1040-215-0x0000000000EA0000-0x0000000000EA2000-memory.dmpFilesize
8KB
-
memory/1040-213-0x0000000002980000-0x0000000002990000-memory.dmpFilesize
64KB
-
memory/1040-212-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-211-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-210-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-209-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-161-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-162-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-163-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-164-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-166-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-165-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-167-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-168-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-169-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-170-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-171-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-172-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-173-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-174-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-175-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-227-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-208-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-155-0x0000000002E10000-0x0000000002F2C000-memory.dmpFilesize
1.1MB
-
memory/1040-207-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-180-0x0000000008D30000-0x0000000008E12000-memory.dmpFilesize
904KB
-
memory/1040-182-0x0000000007460000-0x0000000007470000-memory.dmpFilesize
64KB
-
memory/1040-184-0x0000000008D30000-0x0000000008E12000-memory.dmpFilesize
904KB
-
memory/1040-195-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-196-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-197-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-198-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-199-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-200-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-201-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-202-0x0000000000EA0000-0x0000000000EA2000-memory.dmpFilesize
8KB
-
memory/1040-203-0x0000000002980000-0x0000000002990000-memory.dmpFilesize
64KB
-
memory/1040-204-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-205-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1040-206-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1372-157-0x0000000000050000-0x0000000000066000-memory.dmpFilesize
88KB
-
memory/1372-159-0x0000000000F40000-0x0000000000F6D000-memory.dmpFilesize
180KB
-
memory/1372-160-0x0000000003030000-0x000000000337A000-memory.dmpFilesize
3.3MB
-
memory/1372-178-0x0000000002E50000-0x0000000002EDF000-memory.dmpFilesize
572KB
-
memory/1372-158-0x0000000000050000-0x0000000000066000-memory.dmpFilesize
88KB
-
memory/2876-154-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/2876-153-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2876-151-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2876-152-0x0000000004A60000-0x0000000004DAA000-memory.dmpFilesize
3.3MB
-
memory/2876-149-0x0000000004660000-0x0000000004661000-memory.dmpFilesize
4KB
-
memory/3036-133-0x00000000024E0000-0x000000000250C000-memory.dmpFilesize
176KB
-
memory/3036-135-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/3036-148-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3036-147-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3036-136-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB