Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2023 10:22
Static task
static1
Behavioral task
behavioral1
Sample
7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe
Resource
win10v2004-20231127-en
General
-
Target
7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe
-
Size
2.8MB
-
MD5
c571feca7dd9afeb0076b38e5f5df4c5
-
SHA1
3501d69b6462f6f0702c3af0a5d4cb6e41af0c5c
-
SHA256
7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577
-
SHA512
4a06b25559e186ef776b6f75850a52422509df4b94c2ecd314d4adb76ce68d68970808ba337d77759819be06e99e6fb996d8767161da0ef05c7613e06a20dae7
-
SSDEEP
49152:Xm/PpH8yc0/wU2lpe63ZrxKrVEbRIqiPt41TFehg1mQzZ:XOpcyV/wjpdZrxEVEtI14TqnY
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1304-2-0x0000000004280000-0x0000000005280000-memory.dmp modiloader_stage2 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sfhqlqto = "C:\\Users\\Public\\Sfhqlqto.url" 7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SndVol.exerundll32.exedescription pid process target process PID 1740 set thread context of 3380 1740 SndVol.exe Explorer.EXE PID 4324 set thread context of 3380 4324 rundll32.exe Explorer.EXE -
Processes:
rundll32.exedescription ioc process Key created \Registry\User\S-1-5-21-1067295379-1486014338-1703171060-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 rundll32.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 26 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exeSndVol.exerundll32.exepid process 1304 7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe 1304 7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe 1740 SndVol.exe 1740 SndVol.exe 1740 SndVol.exe 1740 SndVol.exe 1740 SndVol.exe 1740 SndVol.exe 1740 SndVol.exe 1740 SndVol.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3380 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
SndVol.exerundll32.exepid process 1740 SndVol.exe 1740 SndVol.exe 1740 SndVol.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
SndVol.exeExplorer.EXErundll32.exedescription pid process Token: SeDebugPrivilege 1740 SndVol.exe Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeDebugPrivilege 4324 rundll32.exe Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SndVol.exepid process 1740 SndVol.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
SndVol.exepid process 1740 SndVol.exe 1740 SndVol.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3380 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exeExplorer.EXErundll32.exedescription pid process target process PID 1304 wrote to memory of 1740 1304 7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe SndVol.exe PID 1304 wrote to memory of 1740 1304 7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe SndVol.exe PID 1304 wrote to memory of 1740 1304 7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe SndVol.exe PID 1304 wrote to memory of 1740 1304 7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe SndVol.exe PID 3380 wrote to memory of 4324 3380 Explorer.EXE rundll32.exe PID 3380 wrote to memory of 4324 3380 Explorer.EXE rundll32.exe PID 3380 wrote to memory of 4324 3380 Explorer.EXE rundll32.exe PID 4324 wrote to memory of 1712 4324 rundll32.exe Firefox.exe PID 4324 wrote to memory of 1712 4324 rundll32.exe Firefox.exe PID 4324 wrote to memory of 1712 4324 rundll32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe"C:\Users\Admin\AppData\Local\Temp\7ffd894e16efa08b856ea6023135fc537562d9e7424205bed57a54e754643577.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1304-1-0x0000000004280000-0x0000000005280000-memory.dmpFilesize
16.0MB
-
memory/1304-2-0x0000000004280000-0x0000000005280000-memory.dmpFilesize
16.0MB
-
memory/1304-4-0x0000000000400000-0x00000000006DA000-memory.dmpFilesize
2.9MB
-
memory/1304-0-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1740-17-0x00000000224D0000-0x00000000224E0000-memory.dmpFilesize
64KB
-
memory/1740-8-0x0000000002CC0000-0x0000000003CC0000-memory.dmpFilesize
16.0MB
-
memory/1740-9-0x00000000225B0000-0x00000000228FA000-memory.dmpFilesize
3.3MB
-
memory/1740-11-0x0000000002CC0000-0x0000000003CC0000-memory.dmpFilesize
16.0MB
-
memory/1740-12-0x0000000002CC0000-0x0000000003CC0000-memory.dmpFilesize
16.0MB
-
memory/3380-19-0x0000000007C70000-0x0000000007D8B000-memory.dmpFilesize
1.1MB
-
memory/3380-23-0x0000000007D90000-0x0000000007E59000-memory.dmpFilesize
804KB
-
memory/3380-24-0x0000000007D90000-0x0000000007E59000-memory.dmpFilesize
804KB
-
memory/3380-34-0x0000000007D90000-0x0000000007E59000-memory.dmpFilesize
804KB
-
memory/4324-16-0x0000000000E50000-0x0000000000E64000-memory.dmpFilesize
80KB
-
memory/4324-18-0x0000000000380000-0x00000000003AD000-memory.dmpFilesize
180KB
-
memory/4324-13-0x0000000000E50000-0x0000000000E64000-memory.dmpFilesize
80KB
-
memory/4324-20-0x00000000025E0000-0x000000000292A000-memory.dmpFilesize
3.3MB
-
memory/4324-21-0x0000000000380000-0x00000000003AD000-memory.dmpFilesize
180KB
-
memory/4324-22-0x0000000002310000-0x000000000239F000-memory.dmpFilesize
572KB