Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 16:46
Static task
static1
Behavioral task
behavioral1
Sample
dokaz o uplati.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dokaz o uplati.exe
Resource
win10v2004-20240426-en
General
-
Target
dokaz o uplati.exe
-
Size
1.1MB
-
MD5
7d0932523c11c434d2b132a2cf8a5835
-
SHA1
ac083ec95bcab40b618f4f53b76739be81e283f9
-
SHA256
0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666
-
SHA512
1251d346dfe9e51691beff84b3474c0f5a6e5d24339e9d59eaadba227672a5b358e4c1011b602d8d0f8b950a152817f3b15c071fb379e40d79ede4787fc4e00e
-
SSDEEP
24576:FyDuzoeTyNvZ7BIiETeAXsiK/e9cvYLgc4mguZ:Fz4IPTeAX4qMr3B
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1636-2-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-4-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-5-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-3-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-1-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-7-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-10-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-16-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-29-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-57-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-63-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-62-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-60-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-59-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-58-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-56-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-54-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-53-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-52-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-51-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-49-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-48-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-47-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-46-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-45-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-44-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-43-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-41-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-40-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-39-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-38-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-37-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-36-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-35-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-34-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-64-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-61-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-30-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-55-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-50-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-23-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-42-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-22-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-19-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-33-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-18-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-32-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-31-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-17-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-27-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-28-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-15-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-26-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-25-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-14-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-24-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-13-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-21-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-12-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-20-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-11-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-9-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-8-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1636-6-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SndVol.exegrpconv.exedescription pid process target process PID 4884 set thread context of 3444 4884 SndVol.exe Explorer.EXE PID 4884 set thread context of 728 4884 SndVol.exe grpconv.exe PID 728 set thread context of 3444 728 grpconv.exe Explorer.EXE PID 728 set thread context of 608 728 grpconv.exe Firefox.exe -
Processes:
grpconv.exedescription ioc process Key created \Registry\User\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 grpconv.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 25 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
dokaz o uplati.exeSndVol.exegrpconv.exepid process 1636 dokaz o uplati.exe 1636 dokaz o uplati.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 4884 SndVol.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
SndVol.exeExplorer.EXEgrpconv.exepid process 4884 SndVol.exe 3444 Explorer.EXE 3444 Explorer.EXE 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe 728 grpconv.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SndVol.exepid process 4884 SndVol.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
SndVol.exepid process 4884 SndVol.exe 4884 SndVol.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
dokaz o uplati.exeExplorer.EXEgrpconv.exedescription pid process target process PID 1636 wrote to memory of 4884 1636 dokaz o uplati.exe SndVol.exe PID 1636 wrote to memory of 4884 1636 dokaz o uplati.exe SndVol.exe PID 1636 wrote to memory of 4884 1636 dokaz o uplati.exe SndVol.exe PID 1636 wrote to memory of 4884 1636 dokaz o uplati.exe SndVol.exe PID 3444 wrote to memory of 728 3444 Explorer.EXE grpconv.exe PID 3444 wrote to memory of 728 3444 Explorer.EXE grpconv.exe PID 3444 wrote to memory of 728 3444 Explorer.EXE grpconv.exe PID 728 wrote to memory of 608 728 grpconv.exe Firefox.exe PID 728 wrote to memory of 608 728 grpconv.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\dokaz o uplati.exe"C:\Users\Admin\AppData\Local\Temp\dokaz o uplati.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4884 -
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1636-0-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/1636-2-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-4-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-5-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-3-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-1-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-7-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-10-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-16-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-29-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-57-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-63-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-62-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-60-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-59-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-58-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-56-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-54-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-53-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-52-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-51-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-49-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-48-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-47-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-46-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-45-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-44-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-43-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-41-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-40-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-39-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-38-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-37-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-36-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-35-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-34-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-64-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-61-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-30-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-55-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-50-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-23-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-42-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-22-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-19-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-33-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-18-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-32-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-31-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-17-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-27-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-28-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-15-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-26-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-25-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-14-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-24-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-13-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-21-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-12-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-20-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-11-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-9-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-8-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1636-6-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB