Overview

overview

10

Static

static

10

6275a839b5...3b.exe

windows7_x64

10

6275a839b5...3b.exe

windows10_x64

10

Resubmissions

17-01-2021 17:20

210117-42l4186m4a 10

17-01-2021 17:16

210117-436yb29wwa 10

11-01-2021 07:41

210111-s6ytr1ebc2 10

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    11-01-2021 07:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6275a839b5071bf445539c8652d2b13b.exe

  • Size

    1.0MB

  • MD5

    6275a839b5071bf445539c8652d2b13b

  • SHA1

    1e0946ea29e3eca33384ccab5a627d778a6e612d

  • SHA256

    f0aec57001a184ea82122a59c6e5be48042f75d6f11a40125995ba9531aab718

  • SHA512

    f31006c16dc31548283a4434ee4e13e878a24d10c1963d6b81083862a8cd544004612886e77774e3072481fee0411665d6db6ca8d5e25b9e8e72e7252603d677

Score
10/10
modiloaderphobosevasionpersistenceransomwaretrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Drops file in Program Files directory 10383 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 472 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6275a839b5071bf445539c8652d2b13b.exe
    "C:\Users\Admin\AppData\Local\Temp\6275a839b5071bf445539c8652d2b13b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Program Files (x86)\internet explorer\ieinstal.exe
        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
        3⤵
          PID:1504
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3360
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:2112
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2216
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} bootstatuspolicy ignoreallfailures
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:2592
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} recoveryenabled no
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:4032
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:3740
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s seclogon
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2428
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2052
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:584
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:212
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:3812

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Command-Line Interface

      1
      T1059

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      File Deletion

      3
      T1107

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Inhibit System Recovery

      4
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1504-10-0x0000000000000000-mapping.dmp
        Download
      • memory/2112-12-0x0000000000000000-mapping.dmp
        Download
      • memory/2216-13-0x0000000000000000-mapping.dmp
        Download
      • memory/2592-14-0x0000000000000000-mapping.dmp
        Download
      • memory/2600-5-0x0000000000000000-mapping.dmp
        Download
      • memory/2600-8-0x0000000003000000-0x0000000003001000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2600-9-0x0000000000000000-mapping.dmp
        Download
      • memory/2600-7-0x0000000000000000-mapping.dmp
        Download
      • memory/2600-3-0x0000000000000000-mapping.dmp
        Download
      • memory/2600-4-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2600-2-0x0000000000C30000-0x0000000000C31000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3360-11-0x0000000000000000-mapping.dmp
        Download
      • memory/3740-16-0x0000000000000000-mapping.dmp
        Download
      • memory/4032-15-0x0000000000000000-mapping.dmp
        Download