Analysis
-
max time kernel
119s -
max time network
141s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 16:57
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe
-
Size
649KB
-
MD5
3c37c322eabf6eda7375d85e15e3c6e3
-
SHA1
a6cf2cbcf8aee310c4bde6b846a83a91b3855c46
-
SHA256
3cad10488e9efd31ba0fe6cacc311572a2fac4c4760b315e5ce337ea731ce22c
-
SHA512
dfb235f3db2401554e070dc4ba6add57360e8a3327537f83c9fb6397d2b87fae614dba67888ce286f9b8beaab3b34ca903b7bf0bae7705d7402e6615d4822757
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ymtc = "C:\\Users\\Admin\\AppData\\Local\\Ymtc\\Ymtc.hta" SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exedescription pid process target process PID 1520 wrote to memory of 3768 1520 SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe ieinstal.exe PID 1520 wrote to memory of 3768 1520 SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe ieinstal.exe PID 1520 wrote to memory of 3768 1520 SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵