Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2023 10:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Yglwulsvxiiswr.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Yglwulsvxiiswr.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
Yglwulsvxiiswr.exe
-
Size
1.1MB
-
MD5
7f11fbaa2959fa9da839e42e2e52619a
-
SHA1
06b5a1c77c5965950b2b2cccfad6bad9b7579d53
-
SHA256
ac00251b8ba5b7bd219bb23bb5134a11f1215d19aaa0915e5a00d7906906b19a
-
SHA512
92f67ba06e05949870c7aa5f4144125a466d8ea604b116729133a18b287c3d44e584b0091543e04bc8f0fc399754f4a723d08522484390bf2a626cab275421b1
-
SSDEEP
24576:1RxK0h0gJ+HYS9XsILx0P83H5M8OG31WYm3:1RN+Hm3
Malware Config
Extracted
Family
formbook
Version
4.1
Campaign
fadc
Decoy
protechdream.com
faireco.life
bakrinhome.com
bustygirl.xyz
kbif.info
ningo.bond
hollywoodcircleevents.site
eapv-uabjo.com
852bets.com
nooption.online
global-strategy.pro
cartaonline.online
sacredbones2023.com
barsandbands.fun
liftchairs-info-mx.today
delamar.one
shuntianyuan.net
americanworldsolutions.com
julitv.net
criativax.com
edge-estimates.info
fursanalhamayel.com
huilingtong.net
cheemanotary.com
myartgallery.net
mrsearthphilippines.com
auth7070-50.cfd
wrld.site
mypluscoins.com
curvepro.net
petticoatsandpockets.com
dzji12.top
y250rx08ow.top
korearx.com
sensorlightsales.com
kloveloboosting.com
innercircleloans.com
r0g.lat
hombresprostatabio.online
telcosme.com
ansorullawfirm.com
donateprolifeministry.com
wtmidsole.com
tincoco.net
yuanlaigou.net
complete-s.monster
dm16888.xyz
aidadesignhub.com
lcyj.net
qiohdf55123.com
arlnx.com
haixindx.com
2viaequatorial.com
biaogewuliu.com
kristieannmarkets.com
iptvtest.live
vanheltenadviesenfinance.com
seathee.com
ywhlearn.com
eeee84.com
tr-dysonbayisi-tr.com
annaddiddi.com
kmdsz.net
ocseawatch.com
baoshengmaritime.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/2164-7-0x0000000004F60000-0x0000000005F60000-memory.dmp formbook behavioral2/memory/2164-11-0x0000000004F60000-0x0000000005F60000-memory.dmp formbook behavioral2/memory/2676-17-0x0000000000190000-0x00000000001BF000-memory.dmp formbook behavioral2/memory/2676-19-0x0000000000190000-0x00000000001BF000-memory.dmp formbook -
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/3296-1-0x0000000002960000-0x0000000003960000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yglwulsv = "C:\\Users\\Public\\Yglwulsv.url" Yglwulsvxiiswr.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2164 set thread context of 3148 2164 colorcpl.exe 49 PID 2676 set thread context of 3148 2676 cmstp.exe 49 -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 47 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 50 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 3296 Yglwulsvxiiswr.exe 3296 Yglwulsvxiiswr.exe 2164 colorcpl.exe 2164 colorcpl.exe 2164 colorcpl.exe 2164 colorcpl.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe 2676 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3148 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2164 colorcpl.exe 2164 colorcpl.exe 2164 colorcpl.exe 2676 cmstp.exe 2676 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 2164 colorcpl.exe Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeDebugPrivilege 2676 cmstp.exe Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3148 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe PID 3296 wrote to memory of 0 3296 Yglwulsvxiiswr.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\Yglwulsvxiiswr.exe"C:\Users\Admin\AppData\Local\Temp\Yglwulsvxiiswr.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\colorcpl.exe"3⤵PID:4388
-
-