Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-11-2020 20:52
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v20201028
General
-
Target
Setup.exe
-
Size
1.2MB
-
MD5
a65bb98a725359c25ea677337e7bc782
-
SHA1
e54df92418e386aa897e90ef7c635522de974ac5
-
SHA256
2caacde56329c3cb26c041d2535a5121d02fc195193f4046aabec42d61655d68
-
SHA512
795c85440ec8de558837e564e56b13c1976d8e27e004e829d532e61839aae73ae7e9d012a2f49a22dbd7de1d84585b8eb54e9f48561ae0dba30c668511e7407c
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4088-10-0x000000000046C7B8-mapping.dmp modiloader_stage1 behavioral2/memory/4088-9-0x0000000000400000-0x00000000004AF000-memory.dmp modiloader_stage1 behavioral2/memory/4088-11-0x0000000000400000-0x00000000004AF000-memory.dmp modiloader_stage1 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Setup.exedescription ioc process File opened for modification \??\PhysicalDrive0 Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 4764 set thread context of 4088 4764 Setup.exe Setup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exepid process 4764 Setup.exe 4764 Setup.exe 4764 Setup.exe 4764 Setup.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Setup.exedescription pid process Token: SeDebugPrivilege 4764 Setup.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Setup.exedescription pid process target process PID 4764 wrote to memory of 4440 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4440 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4440 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe PID 4764 wrote to memory of 4088 4764 Setup.exe Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Writes to the Master Boot Record (MBR)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4088-10-0x000000000046C7B8-mapping.dmp
-
memory/4088-9-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4088-11-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/4764-0-0x0000000072B20000-0x000000007320E000-memory.dmpFilesize
6.9MB
-
memory/4764-1-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/4764-3-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/4764-4-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/4764-5-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/4764-6-0x0000000006E60000-0x0000000006F58000-memory.dmpFilesize
992KB
-
memory/4764-7-0x0000000007260000-0x00000000072DB000-memory.dmpFilesize
492KB
-
memory/4764-8-0x0000000006810000-0x0000000006826000-memory.dmpFilesize
88KB