Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 11:16
Static task
static1
Behavioral task
behavioral1
Sample
0625413424416272.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0625413424416272.exe
Resource
win10v2004-20230220-en
General
-
Target
0625413424416272.exe
-
Size
821KB
-
MD5
5fc4c73e287297316316d56ec340bb98
-
SHA1
306fd44b6d688e9f84d87e533605121bdf64eb9c
-
SHA256
33ba34d8685f48fc23e074cf802716cce5f1b27a656a0996bdf88232c42a36d7
-
SHA512
76b21a33991414c057d1d6eafa5f8b2327c7b6e1f2aeae6e60fc15f82c65e9c40252f4aaf9d0d3276a7401a6adfb93b35e4794d9987229aa456dcddfcb85f8d8
-
SSDEEP
12288:1xkn6YuwDEgW0+K4tvzxn58XdUpGHnSieAi+Ze643VaxBP:nM6yG0+hhzxnidiGHSi3HuS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3992-133-0x00000000022C0000-0x00000000022EC000-memory.dmp modiloader_stage2 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0625413424416272.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ltxzmasq = "C:\\Users\\Public\\Libraries\\qsamzxtL.url" 0625413424416272.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
iexpress.exewscript.exedescription pid process target process PID 2768 set thread context of 3152 2768 iexpress.exe Explorer.EXE PID 1200 set thread context of 3152 1200 wscript.exe Explorer.EXE -
Processes:
wscript.exedescription ioc process Key created \Registry\User\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
0625413424416272.exeiexpress.exewscript.exepid process 3992 0625413424416272.exe 3992 0625413424416272.exe 2768 iexpress.exe 2768 iexpress.exe 2768 iexpress.exe 2768 iexpress.exe 2768 iexpress.exe 2768 iexpress.exe 2768 iexpress.exe 2768 iexpress.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3152 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
iexpress.exewscript.exepid process 2768 iexpress.exe 2768 iexpress.exe 2768 iexpress.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe 1200 wscript.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
iexpress.exeExplorer.EXEwscript.exedescription pid process Token: SeDebugPrivilege 2768 iexpress.exe Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeDebugPrivilege 1200 wscript.exe Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0625413424416272.exeExplorer.EXEwscript.exedescription pid process target process PID 3992 wrote to memory of 2768 3992 0625413424416272.exe iexpress.exe PID 3992 wrote to memory of 2768 3992 0625413424416272.exe iexpress.exe PID 3992 wrote to memory of 2768 3992 0625413424416272.exe iexpress.exe PID 3992 wrote to memory of 2768 3992 0625413424416272.exe iexpress.exe PID 3992 wrote to memory of 2768 3992 0625413424416272.exe iexpress.exe PID 3992 wrote to memory of 2768 3992 0625413424416272.exe iexpress.exe PID 3152 wrote to memory of 1200 3152 Explorer.EXE wscript.exe PID 3152 wrote to memory of 1200 3152 Explorer.EXE wscript.exe PID 3152 wrote to memory of 1200 3152 Explorer.EXE wscript.exe PID 1200 wrote to memory of 3904 1200 wscript.exe Firefox.exe PID 1200 wrote to memory of 3904 1200 wscript.exe Firefox.exe PID 1200 wrote to memory of 3904 1200 wscript.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0625413424416272.exe"C:\Users\Admin\AppData\Local\Temp\0625413424416272.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iexpress.exeC:\Windows\System32\iexpress.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-162-0x0000000002A00000-0x0000000002A8F000-memory.dmpFilesize
572KB
-
memory/1200-157-0x00000000003B0000-0x00000000003D7000-memory.dmpFilesize
156KB
-
memory/1200-158-0x00000000003B0000-0x00000000003D7000-memory.dmpFilesize
156KB
-
memory/1200-160-0x0000000000B00000-0x0000000000B2D000-memory.dmpFilesize
180KB
-
memory/1200-161-0x0000000002BE0000-0x0000000002F2A000-memory.dmpFilesize
3.3MB
-
memory/2768-151-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2768-152-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2768-153-0x0000000004150000-0x000000000449A000-memory.dmpFilesize
3.3MB
-
memory/2768-154-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/2768-149-0x0000000002C70000-0x0000000002C71000-memory.dmpFilesize
4KB
-
memory/2768-159-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3152-184-0x00000000085B0000-0x000000000865C000-memory.dmpFilesize
688KB
-
memory/3152-201-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-164-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-165-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-166-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-167-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-168-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-169-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-170-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-171-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-172-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-173-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-174-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-175-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-176-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-177-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-178-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-179-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-181-0x00000000030F0000-0x0000000003100000-memory.dmpFilesize
64KB
-
memory/3152-182-0x00000000078F0000-0x0000000007900000-memory.dmpFilesize
64KB
-
memory/3152-183-0x00000000078F0000-0x0000000007900000-memory.dmpFilesize
64KB
-
memory/3152-155-0x00000000084C0000-0x00000000085AE000-memory.dmpFilesize
952KB
-
memory/3152-186-0x00000000078F0000-0x0000000007900000-memory.dmpFilesize
64KB
-
memory/3152-187-0x00000000078F0000-0x0000000007900000-memory.dmpFilesize
64KB
-
memory/3152-188-0x00000000078F0000-0x0000000007900000-memory.dmpFilesize
64KB
-
memory/3152-199-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-200-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-163-0x00000000085B0000-0x000000000865C000-memory.dmpFilesize
688KB
-
memory/3152-202-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-204-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-203-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-205-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-206-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-207-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-208-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-209-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-210-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-211-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-212-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-213-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-214-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-215-0x00000000078F0000-0x0000000007900000-memory.dmpFilesize
64KB
-
memory/3152-217-0x00000000078F0000-0x0000000007900000-memory.dmpFilesize
64KB
-
memory/3152-218-0x00000000078F0000-0x0000000007900000-memory.dmpFilesize
64KB
-
memory/3152-219-0x00000000078F0000-0x0000000007900000-memory.dmpFilesize
64KB
-
memory/3152-225-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-226-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-227-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-228-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-229-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3152-230-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/3992-133-0x00000000022C0000-0x00000000022EC000-memory.dmpFilesize
176KB
-
memory/3992-135-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/3992-136-0x0000000000400000-0x00000000004D7000-memory.dmpFilesize
860KB
-
memory/3992-147-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3992-148-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB