Analysis
-
max time kernel
149s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2023 04:04
Static task
static1
Behavioral task
behavioral1
Sample
Kopija bankovne uplate.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Kopija bankovne uplate.exe
Resource
win10v2004-20231023-en
General
-
Target
Kopija bankovne uplate.exe
-
Size
2.2MB
-
MD5
2effcfc08d769d5a45ec793864013d1f
-
SHA1
a5ee4caf50df0611dffccc21ee7cc12e2fcce6b6
-
SHA256
7056d549ba61408c2967bd1b277aad3134ab22afda1ef861c238f2c5598c3420
-
SHA512
3fe98186ada1d72ab1fb5a9bbfc1d631bfd6ae780439f6e5e5cfcf93042ee41c9162e148ee3a5161481a3b9f6d914babf146ae328ebe83a786a8e58908156ae3
-
SSDEEP
49152:JWPpH8yc0/wU2lpe63ZrxKrVEbRIqiPt41+Fehg1mQmPoE:JCpcyV/wjpdZrxEVEtI14kqnLPoE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1272-3-0x0000000002E40000-0x0000000003E40000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Kopija bankovne uplate.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eplfookz = "C:\\Users\\Public\\Eplfookz.url" Kopija bankovne uplate.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
colorcpl.execmmon32.exedescription pid process target process PID 4088 set thread context of 3316 4088 colorcpl.exe Explorer.EXE PID 4588 set thread context of 3316 4588 cmmon32.exe Explorer.EXE -
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 22 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
Kopija bankovne uplate.execolorcpl.execmmon32.exepid process 1272 Kopija bankovne uplate.exe 1272 Kopija bankovne uplate.exe 4088 colorcpl.exe 4088 colorcpl.exe 4088 colorcpl.exe 4088 colorcpl.exe 4088 colorcpl.exe 4088 colorcpl.exe 4088 colorcpl.exe 4088 colorcpl.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3316 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
colorcpl.execmmon32.exepid process 4088 colorcpl.exe 4088 colorcpl.exe 4088 colorcpl.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe 4588 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
colorcpl.exeExplorer.EXEcmmon32.exedescription pid process Token: SeDebugPrivilege 4088 colorcpl.exe Token: SeShutdownPrivilege 3316 Explorer.EXE Token: SeCreatePagefilePrivilege 3316 Explorer.EXE Token: SeShutdownPrivilege 3316 Explorer.EXE Token: SeCreatePagefilePrivilege 3316 Explorer.EXE Token: SeDebugPrivilege 4588 cmmon32.exe Token: SeShutdownPrivilege 3316 Explorer.EXE Token: SeCreatePagefilePrivilege 3316 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3316 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Kopija bankovne uplate.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1272 wrote to memory of 4088 1272 Kopija bankovne uplate.exe colorcpl.exe PID 1272 wrote to memory of 4088 1272 Kopija bankovne uplate.exe colorcpl.exe PID 1272 wrote to memory of 4088 1272 Kopija bankovne uplate.exe colorcpl.exe PID 1272 wrote to memory of 4088 1272 Kopija bankovne uplate.exe colorcpl.exe PID 3316 wrote to memory of 4588 3316 Explorer.EXE cmmon32.exe PID 3316 wrote to memory of 4588 3316 Explorer.EXE cmmon32.exe PID 3316 wrote to memory of 4588 3316 Explorer.EXE cmmon32.exe PID 4588 wrote to memory of 4108 4588 cmmon32.exe Firefox.exe PID 4588 wrote to memory of 4108 4588 cmmon32.exe Firefox.exe PID 4588 wrote to memory of 4108 4588 cmmon32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\Kopija bankovne uplate.exe"C:\Users\Admin\AppData\Local\Temp\Kopija bankovne uplate.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4088 -
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4108