Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2023 16:29
Static task
static1
Behavioral task
behavioral1
Sample
Orderq.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Orderq.exe
Resource
win10v2004-20231127-en
General
-
Target
Orderq.exe
-
Size
2.8MB
-
MD5
06d908f5a0ad081c36c1f29c5bb8531b
-
SHA1
c4d069ea2ce5871a2e55a680b660de4ff88d8437
-
SHA256
7dca9d872ff0b85e7914cd56ad409f3ba86f6171225a3627b736768872fb0eff
-
SHA512
dbd417e7d2132895af032a42704462fc8919616912774a3d8159a59e9e1b71400afb52e1230746f3da7a80e1a639168ec0d29f57b808f1ba06bfb2adbd6cbb5d
-
SSDEEP
49152:Xm/PpH8yc0/wU2lpe63ZrxKrVEbRIqiPt41yFehg1mQzZ:XOpcyV/wjpdZrxEVEtI14AqnY
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1104-2-0x00000000044C0000-0x00000000054C0000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Orderq.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bnhnkznp = "C:\\Users\\Public\\Bnhnkznp.url" Orderq.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 224 1104 WerFault.exe Orderq.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 32 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 34 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Orderq.exepid process 1104 Orderq.exe 1104 Orderq.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Orderq.exedescription pid process target process PID 1104 wrote to memory of 1840 1104 Orderq.exe colorcpl.exe PID 1104 wrote to memory of 1840 1104 Orderq.exe colorcpl.exe PID 1104 wrote to memory of 1840 1104 Orderq.exe colorcpl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Orderq.exe"C:\Users\Admin\AppData\Local\Temp\Orderq.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 17962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1104 -ip 11041⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1104-0-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/1104-1-0x00000000044C0000-0x00000000054C0000-memory.dmpFilesize
16.0MB
-
memory/1104-2-0x00000000044C0000-0x00000000054C0000-memory.dmpFilesize
16.0MB
-
memory/1104-4-0x0000000000400000-0x00000000006DA000-memory.dmpFilesize
2.9MB