Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 01:19
Static task
static1
Behavioral task
behavioral1
Sample
1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe
Resource
win10v2004-20230220-en
General
-
Target
1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe
-
Size
665KB
-
MD5
67a09ce3a6ac852a8d493d41ac68231c
-
SHA1
0a4feb27fbf7af7465ffd3579cf79932ae64af61
-
SHA256
1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d
-
SHA512
02b2265c9c6c79569892f5f09b8d8c11e8dd6f287e4910927e4ee3891078acdf07437acdd9764ab59bb908731ab97b58eaccbff88dbc4f8da779009f0dd5e156
-
SSDEEP
12288:7xsnwyGGFm7NjhBBBHS4PKZr7j65hhxqeIpqOZODCFwxK:7yw0m5jhBBc4yZr7shCBiCix
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4764-134-0x0000000003E30000-0x0000000003E5C000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tcytakyi = "C:\\Users\\Public\\Libraries\\iykatycT.url" 1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
iexpress.exeipconfig.exedescription pid process target process PID 2948 set thread context of 3112 2948 iexpress.exe Explorer.EXE PID 672 set thread context of 3112 672 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 672 ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exeiexpress.exeipconfig.exepid process 4764 1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe 4764 1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe 2948 iexpress.exe 2948 iexpress.exe 2948 iexpress.exe 2948 iexpress.exe 2948 iexpress.exe 2948 iexpress.exe 2948 iexpress.exe 2948 iexpress.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3112 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
iexpress.exeipconfig.exepid process 2948 iexpress.exe 2948 iexpress.exe 2948 iexpress.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe 672 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
iexpress.exeExplorer.EXEipconfig.exedescription pid process Token: SeDebugPrivilege 2948 iexpress.exe Token: SeShutdownPrivilege 3112 Explorer.EXE Token: SeCreatePagefilePrivilege 3112 Explorer.EXE Token: SeShutdownPrivilege 3112 Explorer.EXE Token: SeCreatePagefilePrivilege 3112 Explorer.EXE Token: SeDebugPrivilege 672 ipconfig.exe Token: SeShutdownPrivilege 3112 Explorer.EXE Token: SeCreatePagefilePrivilege 3112 Explorer.EXE Token: SeShutdownPrivilege 3112 Explorer.EXE Token: SeCreatePagefilePrivilege 3112 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exeExplorer.EXEipconfig.exedescription pid process target process PID 4764 wrote to memory of 2948 4764 1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe iexpress.exe PID 4764 wrote to memory of 2948 4764 1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe iexpress.exe PID 4764 wrote to memory of 2948 4764 1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe iexpress.exe PID 4764 wrote to memory of 2948 4764 1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe iexpress.exe PID 4764 wrote to memory of 2948 4764 1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe iexpress.exe PID 4764 wrote to memory of 2948 4764 1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe iexpress.exe PID 3112 wrote to memory of 672 3112 Explorer.EXE ipconfig.exe PID 3112 wrote to memory of 672 3112 Explorer.EXE ipconfig.exe PID 3112 wrote to memory of 672 3112 Explorer.EXE ipconfig.exe PID 672 wrote to memory of 4956 672 ipconfig.exe Firefox.exe PID 672 wrote to memory of 4956 672 ipconfig.exe Firefox.exe PID 672 wrote to memory of 4956 672 ipconfig.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe"C:\Users\Admin\AppData\Local\Temp\1980f4cf17585ba77a0ca7596b1be2e928ead3e98f5cd80b1c005968275ef74d.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iexpress.exeC:\Windows\System32\iexpress.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-157-0x00000000009A0000-0x00000000009AB000-memory.dmpFilesize
44KB
-
memory/672-161-0x00000000017B0000-0x000000000183F000-memory.dmpFilesize
572KB
-
memory/672-160-0x0000000001B20000-0x0000000001E6A000-memory.dmpFilesize
3.3MB
-
memory/672-159-0x0000000001280000-0x00000000012AD000-memory.dmpFilesize
180KB
-
memory/672-158-0x00000000009A0000-0x00000000009AB000-memory.dmpFilesize
44KB
-
memory/2948-154-0x0000000003750000-0x0000000003760000-memory.dmpFilesize
64KB
-
memory/2948-151-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2948-152-0x0000000003890000-0x0000000003BDA000-memory.dmpFilesize
3.3MB
-
memory/2948-153-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2948-149-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/3112-155-0x0000000002C30000-0x0000000002CF1000-memory.dmpFilesize
772KB
-
memory/3112-162-0x0000000002DB0000-0x0000000002E45000-memory.dmpFilesize
596KB
-
memory/3112-164-0x0000000002DB0000-0x0000000002E45000-memory.dmpFilesize
596KB
-
memory/4764-133-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4764-148-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4764-147-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4764-136-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4764-134-0x0000000003E30000-0x0000000003E5C000-memory.dmpFilesize
176KB