Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 15:33
Static task
static1
Behavioral task
behavioral1
Sample
9027be4d12c0d743572bb5cdb7ce0830.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9027be4d12c0d743572bb5cdb7ce0830.exe
Resource
win10v20201028
General
-
Target
9027be4d12c0d743572bb5cdb7ce0830.exe
-
Size
592KB
-
MD5
9027be4d12c0d743572bb5cdb7ce0830
-
SHA1
92945ad64ade75b0fada829c0d377ed9b6e0798e
-
SHA256
32d01c26f7744dc8e4854fb23254f7101950aece9afe54b101d74b3d8d38e84f
-
SHA512
9414284504b514ea88c3307c4089baf6e62c3349b58f8c189d469d5e94dd7fa6cce21bb6cb782ce92d7bf5ea472b7015cc461ccb0f4c7b11b9acb4d4bea658a6
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/788-2-0x00000000003A0000-0x00000000003B0000-memory.dmp modiloader_stage1 -
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/788-4-0x0000000004560000-0x00000000045B8000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9027be4d12c0d743572bb5cdb7ce0830.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Oswr = "C:\\Users\\Admin\\AppData\\Local\\Oswr.url" 9027be4d12c0d743572bb5cdb7ce0830.exe -
Processes:
9027be4d12c0d743572bb5cdb7ce0830.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 9027be4d12c0d743572bb5cdb7ce0830.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 9027be4d12c0d743572bb5cdb7ce0830.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 9027be4d12c0d743572bb5cdb7ce0830.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ieinstal.exepid process 432 ieinstal.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
9027be4d12c0d743572bb5cdb7ce0830.exedescription pid process target process PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe PID 788 wrote to memory of 432 788 9027be4d12c0d743572bb5cdb7ce0830.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9027be4d12c0d743572bb5cdb7ce0830.exe"C:\Users\Admin\AppData\Local\Temp\9027be4d12c0d743572bb5cdb7ce0830.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-5-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/432-6-0x0000000000000000-mapping.dmp
-
memory/432-7-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/432-8-0x0000000000000000-mapping.dmp
-
memory/432-10-0x0000000000000000-mapping.dmp
-
memory/432-13-0x0000000000000000-mapping.dmp
-
memory/432-12-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/788-2-0x00000000003A0000-0x00000000003B0000-memory.dmpFilesize
64KB
-
memory/788-4-0x0000000004560000-0x00000000045B8000-memory.dmpFilesize
352KB
-
memory/788-11-0x0000000010540000-0x0000000010565000-memory.dmpFilesize
148KB
-
memory/864-3-0x000007FEF7D30000-0x000007FEF7FAA000-memory.dmpFilesize
2.5MB