Analysis
-
max time kernel
167s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2023 09:21
Static task
static1
Behavioral task
behavioral1
Sample
Kopija bankovne uplate.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Kopija bankovne uplate.exe
Resource
win10v2004-20231023-en
General
-
Target
Kopija bankovne uplate.exe
-
Size
2.2MB
-
MD5
2effcfc08d769d5a45ec793864013d1f
-
SHA1
a5ee4caf50df0611dffccc21ee7cc12e2fcce6b6
-
SHA256
7056d549ba61408c2967bd1b277aad3134ab22afda1ef861c238f2c5598c3420
-
SHA512
3fe98186ada1d72ab1fb5a9bbfc1d631bfd6ae780439f6e5e5cfcf93042ee41c9162e148ee3a5161481a3b9f6d914babf146ae328ebe83a786a8e58908156ae3
-
SSDEEP
49152:JWPpH8yc0/wU2lpe63ZrxKrVEbRIqiPt41+Fehg1mQmPoE:JCpcyV/wjpdZrxEVEtI14kqnLPoE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2060-6-0x0000000002E30000-0x0000000003E30000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Kopija bankovne uplate.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eplfookz = "C:\\Users\\Public\\Eplfookz.url" Kopija bankovne uplate.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
colorcpl.execolorcpl.exedescription pid process target process PID 4036 set thread context of 3320 4036 colorcpl.exe Explorer.EXE PID 3592 set thread context of 3320 3592 colorcpl.exe Explorer.EXE -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 36 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 38 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Kopija bankovne uplate.execolorcpl.execolorcpl.exepid process 2060 Kopija bankovne uplate.exe 2060 Kopija bankovne uplate.exe 4036 colorcpl.exe 4036 colorcpl.exe 4036 colorcpl.exe 4036 colorcpl.exe 4036 colorcpl.exe 4036 colorcpl.exe 4036 colorcpl.exe 4036 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3320 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
colorcpl.execolorcpl.exepid process 4036 colorcpl.exe 4036 colorcpl.exe 4036 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
colorcpl.exeExplorer.EXEcolorcpl.exedescription pid process Token: SeDebugPrivilege 4036 colorcpl.exe Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeDebugPrivilege 3592 colorcpl.exe Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE Token: SeShutdownPrivilege 3320 Explorer.EXE Token: SeCreatePagefilePrivilege 3320 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Kopija bankovne uplate.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 2060 wrote to memory of 4036 2060 Kopija bankovne uplate.exe colorcpl.exe PID 2060 wrote to memory of 4036 2060 Kopija bankovne uplate.exe colorcpl.exe PID 2060 wrote to memory of 4036 2060 Kopija bankovne uplate.exe colorcpl.exe PID 2060 wrote to memory of 4036 2060 Kopija bankovne uplate.exe colorcpl.exe PID 3320 wrote to memory of 3592 3320 Explorer.EXE colorcpl.exe PID 3320 wrote to memory of 3592 3320 Explorer.EXE colorcpl.exe PID 3320 wrote to memory of 3592 3320 Explorer.EXE colorcpl.exe PID 3592 wrote to memory of 4140 3592 colorcpl.exe Firefox.exe PID 3592 wrote to memory of 4140 3592 colorcpl.exe Firefox.exe PID 3592 wrote to memory of 4140 3592 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Kopija bankovne uplate.exe"C:\Users\Admin\AppData\Local\Temp\Kopija bankovne uplate.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2060-0-0x00000000024D0000-0x00000000024D1000-memory.dmpFilesize
4KB
-
memory/2060-1-0x0000000000400000-0x0000000000640000-memory.dmpFilesize
2.2MB
-
memory/2060-2-0x0000000002E30000-0x0000000003E30000-memory.dmpFilesize
16.0MB
-
memory/2060-3-0x0000000000400000-0x0000000000640000-memory.dmpFilesize
2.2MB
-
memory/2060-4-0x0000000000400000-0x0000000000640000-memory.dmpFilesize
2.2MB
-
memory/2060-5-0x00000000024D0000-0x00000000024D1000-memory.dmpFilesize
4KB
-
memory/2060-6-0x0000000002E30000-0x0000000003E30000-memory.dmpFilesize
16.0MB
-
memory/2060-8-0x0000000000400000-0x0000000000640000-memory.dmpFilesize
2.2MB
-
memory/3320-79-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-32-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-100-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-102-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-101-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-17-0x0000000008830000-0x00000000088FA000-memory.dmpFilesize
808KB
-
memory/3320-99-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-49-0x0000000008A20000-0x0000000008B28000-memory.dmpFilesize
1.0MB
-
memory/3320-98-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-97-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-96-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-95-0x00000000010E0000-0x00000000010F0000-memory.dmpFilesize
64KB
-
memory/3320-26-0x0000000008A20000-0x0000000008B28000-memory.dmpFilesize
1.0MB
-
memory/3320-53-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-28-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-30-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-31-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-54-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-34-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-36-0x0000000003030000-0x0000000003032000-memory.dmpFilesize
8KB
-
memory/3320-35-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-37-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-38-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-42-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-40-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-39-0x0000000003380000-0x000000000338C000-memory.dmpFilesize
48KB
-
memory/3320-46-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-44-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-48-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-52-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-51-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-50-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-94-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-25-0x0000000008A20000-0x0000000008B28000-memory.dmpFilesize
1.0MB
-
memory/3320-93-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-56-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-57-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-64-0x0000000003030000-0x0000000003032000-memory.dmpFilesize
8KB
-
memory/3320-66-0x0000000003380000-0x000000000338C000-memory.dmpFilesize
48KB
-
memory/3320-72-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-74-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-75-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-73-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-76-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-78-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-80-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-92-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-81-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-82-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-83-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-84-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-85-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-88-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-87-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-90-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3320-86-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/3592-20-0x0000000000C10000-0x0000000000C29000-memory.dmpFilesize
100KB
-
memory/3592-24-0x0000000001140000-0x00000000011CF000-memory.dmpFilesize
572KB
-
memory/3592-23-0x0000000000BB0000-0x0000000000BDD000-memory.dmpFilesize
180KB
-
memory/3592-22-0x0000000002E60000-0x00000000031AA000-memory.dmpFilesize
3.3MB
-
memory/3592-21-0x0000000000BB0000-0x0000000000BDD000-memory.dmpFilesize
180KB
-
memory/3592-18-0x0000000000C10000-0x0000000000C29000-memory.dmpFilesize
100KB
-
memory/4036-11-0x0000000004FE0000-0x0000000005FE0000-memory.dmpFilesize
16.0MB
-
memory/4036-14-0x000000001D110000-0x000000001D45A000-memory.dmpFilesize
3.3MB
-
memory/4036-16-0x000000001CFE0000-0x000000001CFF0000-memory.dmpFilesize
64KB
-
memory/4036-15-0x0000000004FE0000-0x0000000005FE0000-memory.dmpFilesize
16.0MB
-
memory/4036-13-0x0000000004FE0000-0x0000000005FE0000-memory.dmpFilesize
16.0MB