Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
13-07-2020 14:24
Static task
static1
Behavioral task
behavioral1
Sample
Loading-Document.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Loading-Document.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Loading-Document.exe
-
Size
1.1MB
-
MD5
95b2c06fe00c2d75fa7b16c7c17074f7
-
SHA1
9657218cd47d2a6b872e35975f9d1ea352cf972c
-
SHA256
3d29d5ec9db9f11b9e20b2c0a27a74846fa9a6c74c8183826b08d48e1b231204
-
SHA512
eb8b2e06f90905f2b540ba45b02c06ac04bf0601495435f766f56a11c0a06cab8eaa999dda13f8bf7c991fc46dad0f65fad1c024702c25c4f3d292ee64decf4b
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ServiceHost packer 2 IoCs
Detects ServiceHost packer used for .NET malware
Processes:
resource yara_rule behavioral2/memory/1964-2-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1964-4-0x0000000000000000-mapping.dmp servicehost -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Loading-Document.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ycoe = "C:\\Users\\Admin\\AppData\\Local\\Ycoe\\Ycoe.hta" Loading-Document.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ieinstal.exepid process 1964 ieinstal.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Loading-Document.exedescription pid process target process PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe PID 2804 wrote to memory of 1964 2804 Loading-Document.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loading-Document.exe"C:\Users\Admin\AppData\Local\Temp\Loading-Document.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1964