Analysis
-
max time kernel
299s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2023 10:07
Static task
static1
Behavioral task
behavioral1
Sample
Ref No.72705JA.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Ref No.72705JA.exe
Resource
win10v2004-20230220-en
General
-
Target
Ref No.72705JA.exe
-
Size
1.0MB
-
MD5
c37c80e84441d6e33c065c562287f831
-
SHA1
3e3eae640ac15ad0c7163346f4b77d49248e0233
-
SHA256
ce010315e45ac1bbd373c48807b19c342de9b486d84adbf4e3a75324c5caea04
-
SHA512
e2ad5a912cfec1bfb906ad3a91dfe50f2759cbb26855354bd411001d653bc41da4d290e58ee333916607d4a1468e81e3a8c2824cfd6d000671453499f22bb4a3
-
SSDEEP
24576:v6R9yfVUXwTEfF59XADz3OjaZQQJ0nhUGfApfLM:v6mO0MF59XADzejakuGfAJM
Malware Config
Extracted
formbook
nvp4
EiywrQNofDNveWY1IESoBA==
yqEWFGRfErX7ICQCwyQ+YeLXtaA=
Ers0rc50nbjso0jbdZTmBw==
XQxVP45+F5OZn3ZBTC7MLe1OF3G5c5uK9A==
RHh4uwtsttjzlxy+eW3+
W+xQshfnvmF5n5x2d+cEVdBNIkQRHRE=
FwlyiuXNX0+Trw==
euLn91on/7DeDe++zbQ4YeLXtaA=
td4cO8m3HDRWtl8p7Q==
ZrlyAAPqc3GXI5k=
OM0IisKOI78FJC/IuIxxAu5nRg==
d6A0QJ6PV+AOpyK+eW3+
+EgxFWUu3Ulatl8p7Q==
GC/stck1ILXn+cWZx7w8W6rPFmO6c5uK9A==
hhIiK4+CKEOfB4tr
mA1pyQ85ye8N
4xgWYcEpEoidv8eXKNncAQ==
L+hOVbe+IWyc8oVUclc=
J7EGaJ+L+wKLXUYg7w==
L5R/nfdgQdMHD+TUKw1Zo3Hb
E4z2kWG/vE6yt5E=
+efGEVp82EycSL2U4cpFU2an/aM5SDuF
6zA2kAqIdAQKkve6y7RjtRBf+i8Nvw==
VRqXzvXLVF+hS9arybBihGeOTaKP
PgKByBDCpL4cd9+yO52n/xZmQZeF
pMit5lre4GVyi3xcfywQY58=
F/vD9x4Oz0RWtl8p7Q==
hvZhvTgp/H7Lm2RNdl0=
h/xWhNLDOEpSZUTmIguoBA==
o8qw6kCdiDV4kn1FMZ6et06V+dCQZEmG
bgMOGYox8vMQ
YmFKj+ZWVRBcep49cl0=
Wox2hOnIRnGp3s2RMZ9Zo3Hb
eeTk5zCrpCpSyntTeF0=
FOA7J3NsxuomwEARYVLNU1TR
yuLXKrWb72SKrA==
K6T6LoiKKwZrHY5i
B8UkEkol7nBvrLeOjSwQY58=
GwvWc8gVAk6yt5E=
4IboPYD24Hqi5mxf+g==
L4XQI2A00QtXxxi+eW3+
doMqp/ZMkE6yt5E=
1ebXKoTs0GSYqMZZc1U=
CYnoUKIiG5vI4/HHLNXpCw==
P/FwuirU0FeJxseeKNncAQ==
N21GaMlCYhFbtl8p7Q==
KY95j+NDjk6yt5E=
C/rJL7ACO0yfB4tr
z6QDKYo85+nxAx+zmTgBLYY=
IPBjddXCgzlvd2Y/C3KaMomhUQ==
KNsyKXJjN+wYPi8OLgNZo3Hb
kht0meHAHPpzqQ==
Rm5BMnxa1/s/yxq2wSJcfpc=
+Tn9l2Ax8vMQ
rwkQV4ruG7v1/s+ZKNncAQ==
7+RhcuhVYBpggr5YZUw=
YRaX4klS4xWfB4tr
YIZ5wgZjYOsslloz9A==
+SAdmP/smDZ6oKF4GxNZo3Hb
mSIWBEa/uz9JSodz
PGc0UrsbRk1LwHVWOp+9CQ==
DnJQctQ5jE6yt5E=
gYmlw+nLOxtYl4k=
eRJtqhQDH3KQsg==
brainbookgroup.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1952-133-0x00000000022C0000-0x00000000022EC000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Ref No.72705JA.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jxrhhqra = "C:\\Users\\Public\\Libraries\\arqhhrxJ.url" Ref No.72705JA.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
colorcpl.exesvchost.exedescription pid process target process PID 3476 set thread context of 3148 3476 colorcpl.exe Explorer.EXE PID 3476 set thread context of 3148 3476 colorcpl.exe Explorer.EXE PID 4880 set thread context of 3148 4880 svchost.exe Explorer.EXE -
Processes:
svchost.exedescription ioc process Key created \Registry\User\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Ref No.72705JA.execolorcpl.exesvchost.exepid process 1952 Ref No.72705JA.exe 1952 Ref No.72705JA.exe 1952 Ref No.72705JA.exe 1952 Ref No.72705JA.exe 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3148 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
colorcpl.exesvchost.exepid process 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 3476 colorcpl.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe 4880 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
colorcpl.exeExplorer.EXEsvchost.exedescription pid process Token: SeDebugPrivilege 3476 colorcpl.exe Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeDebugPrivilege 4880 svchost.exe Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Ref No.72705JA.exeExplorer.EXEsvchost.exedescription pid process target process PID 1952 wrote to memory of 3476 1952 Ref No.72705JA.exe colorcpl.exe PID 1952 wrote to memory of 3476 1952 Ref No.72705JA.exe colorcpl.exe PID 1952 wrote to memory of 3476 1952 Ref No.72705JA.exe colorcpl.exe PID 1952 wrote to memory of 3476 1952 Ref No.72705JA.exe colorcpl.exe PID 1952 wrote to memory of 3476 1952 Ref No.72705JA.exe colorcpl.exe PID 1952 wrote to memory of 3476 1952 Ref No.72705JA.exe colorcpl.exe PID 3148 wrote to memory of 4880 3148 Explorer.EXE svchost.exe PID 3148 wrote to memory of 4880 3148 Explorer.EXE svchost.exe PID 3148 wrote to memory of 4880 3148 Explorer.EXE svchost.exe PID 4880 wrote to memory of 2648 4880 svchost.exe Firefox.exe PID 4880 wrote to memory of 2648 4880 svchost.exe Firefox.exe PID 4880 wrote to memory of 2648 4880 svchost.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\Ref No.72705JA.exe"C:\Users\Admin\AppData\Local\Temp\Ref No.72705JA.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3476 -
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1348
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1952-135-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/1952-136-0x0000000000400000-0x000000000050A000-memory.dmpFilesize
1.0MB
-
memory/1952-147-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1952-148-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1952-133-0x00000000022C0000-0x00000000022EC000-memory.dmpFilesize
176KB
-
memory/3148-159-0x0000000008140000-0x0000000008224000-memory.dmpFilesize
912KB
-
memory/3148-174-0x0000000008230000-0x00000000082E1000-memory.dmpFilesize
708KB
-
memory/3148-172-0x0000000008230000-0x00000000082E1000-memory.dmpFilesize
708KB
-
memory/3148-171-0x0000000008230000-0x00000000082E1000-memory.dmpFilesize
708KB
-
memory/3148-169-0x0000000008140000-0x0000000008224000-memory.dmpFilesize
912KB
-
memory/3148-156-0x0000000002C40000-0x0000000002D06000-memory.dmpFilesize
792KB
-
memory/3476-158-0x00000000047A0000-0x00000000047B0000-memory.dmpFilesize
64KB
-
memory/3476-155-0x0000000004690000-0x00000000046A0000-memory.dmpFilesize
64KB
-
memory/3476-163-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3476-154-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3476-153-0x00000000047D0000-0x0000000004B1A000-memory.dmpFilesize
3.3MB
-
memory/3476-152-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3476-149-0x0000000002290000-0x0000000002291000-memory.dmpFilesize
4KB
-
memory/4880-161-0x0000000000CC0000-0x0000000000CCE000-memory.dmpFilesize
56KB
-
memory/4880-164-0x0000000000CC0000-0x0000000000CCE000-memory.dmpFilesize
56KB
-
memory/4880-165-0x0000000000880000-0x00000000008AD000-memory.dmpFilesize
180KB
-
memory/4880-166-0x0000000001400000-0x000000000174A000-memory.dmpFilesize
3.3MB
-
memory/4880-167-0x0000000000880000-0x00000000008AD000-memory.dmpFilesize
180KB
-
memory/4880-170-0x0000000001200000-0x000000000128F000-memory.dmpFilesize
572KB