Analysis
-
max time kernel
118s -
max time network
117s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-11-2020 20:52
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v20201028
General
-
Target
Setup.exe
-
Size
1.2MB
-
MD5
a65bb98a725359c25ea677337e7bc782
-
SHA1
e54df92418e386aa897e90ef7c635522de974ac5
-
SHA256
2caacde56329c3cb26c041d2535a5121d02fc195193f4046aabec42d61655d68
-
SHA512
795c85440ec8de558837e564e56b13c1976d8e27e004e829d532e61839aae73ae7e9d012a2f49a22dbd7de1d84585b8eb54e9f48561ae0dba30c668511e7407c
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1524-6-0x0000000000400000-0x00000000004AF000-memory.dmp modiloader_stage1 behavioral1/memory/1524-7-0x000000000046C7B8-mapping.dmp modiloader_stage1 behavioral1/memory/1524-8-0x0000000000400000-0x00000000004AF000-memory.dmp modiloader_stage1 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Setup.exedescription ioc process File opened for modification \??\PhysicalDrive0 Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 740 set thread context of 1524 740 Setup.exe Setup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exepid process 740 Setup.exe 740 Setup.exe 740 Setup.exe 740 Setup.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Setup.exedescription pid process Token: SeDebugPrivilege 740 Setup.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Setup.exedescription pid process target process PID 740 wrote to memory of 1444 740 Setup.exe Setup.exe PID 740 wrote to memory of 1444 740 Setup.exe Setup.exe PID 740 wrote to memory of 1444 740 Setup.exe Setup.exe PID 740 wrote to memory of 1444 740 Setup.exe Setup.exe PID 740 wrote to memory of 1444 740 Setup.exe Setup.exe PID 740 wrote to memory of 1444 740 Setup.exe Setup.exe PID 740 wrote to memory of 1444 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe PID 740 wrote to memory of 1524 740 Setup.exe Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Writes to the Master Boot Record (MBR)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/740-0-0x0000000073FC0000-0x00000000746AE000-memory.dmpFilesize
6.9MB
-
memory/740-1-0x00000000011C0000-0x00000000011C1000-memory.dmpFilesize
4KB
-
memory/740-3-0x0000000005D40000-0x0000000005E38000-memory.dmpFilesize
992KB
-
memory/740-4-0x0000000004E00000-0x0000000004E7B000-memory.dmpFilesize
492KB
-
memory/740-5-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/1524-6-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1524-7-0x000000000046C7B8-mapping.dmp
-
memory/1524-8-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB