Analysis
- max time kernel
77s - max time network
141s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
26/01/2022, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
T49900783-Confirm-20220126-788088-Email-8700787.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
T49900783-Confirm-20220126-788088-Email-8700787.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target T49900783-Confirm-20220126-788088-Email-8700787.exe
- Size 869KB
- Sample220126-mxtzescdc4
- SHA256 4e837a08dd24b1f710c6fce10f974a49141decf103d6aeb290c0d36bba75121b
- MD5 4655448051058c4ba29f69a8b78003d2
- SHA1 b57d558c87429777d650cb47b283d3379c4b92d6
- SHA512 4f27e488782fee77ea445d51c9df9af677c9cb37de727c4765c02e7ccfe40837fd321a119ab2b622f7e90682cf22e22bc04d347f39d5a1505a025b6a18c12e9f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader First Stage 1 IoCs
resource yara_rule behavioral2/memory/1816-117-0x00000000023C0000-0x00000000023DB000-memory.dmp modiloader_stage1 - Executes dropped EXE 1 IoCs
pid Process 1360 ComputerDefaults.exe - Loads dropped DLL 1 IoCs
pid Process 1360 ComputerDefaults.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sawupcoqqr = "C:\\Users\\Admin\\Contacts\\rqqocpuwaS.url" T49900783-Confirm-20220126-788088-Email-8700787.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2248 2436 WerFault.exe 69 - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1764 PING.EXE - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2008 powershell.exe 2008 powershell.exe 2008 powershell.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe - Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeRestorePrivilege 2248 WerFault.exe Token: SeBackupPrivilege 2248 WerFault.exe Token: SeDebugPrivilege 2008 powershell.exe Token: SeDebugPrivilege 2248 WerFault.exe Token: SeIncreaseQuotaPrivilege 2008 powershell.exe Token: SeSecurityPrivilege 2008 powershell.exe Token: SeTakeOwnershipPrivilege 2008 powershell.exe Token: SeLoadDriverPrivilege 2008 powershell.exe Token: SeSystemProfilePrivilege 2008 powershell.exe Token: SeSystemtimePrivilege 2008 powershell.exe Token: SeProfSingleProcessPrivilege 2008 powershell.exe Token: SeIncBasePriorityPrivilege 2008 powershell.exe Token: SeCreatePagefilePrivilege 2008 powershell.exe Token: SeBackupPrivilege 2008 powershell.exe Token: SeRestorePrivilege 2008 powershell.exe Token: SeShutdownPrivilege 2008 powershell.exe Token: SeDebugPrivilege 2008 powershell.exe Token: SeSystemEnvironmentPrivilege 2008 powershell.exe Token: SeRemoteShutdownPrivilege 2008 powershell.exe Token: SeUndockPrivilege 2008 powershell.exe Token: SeManageVolumePrivilege 2008 powershell.exe Token: 33 2008 powershell.exe Token: 34 2008 powershell.exe Token: 35 2008 powershell.exe Token: 36 2008 powershell.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2436 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 69 PID 1816 wrote to memory of 2336 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 71 PID 1816 wrote to memory of 2336 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 71 PID 1816 wrote to memory of 2336 1816 T49900783-Confirm-20220126-788088-Email-8700787.exe 71 PID 2336 wrote to memory of 3948 2336 cmd.exe 73 PID 2336 wrote to memory of 3948 2336 cmd.exe 73 PID 2336 wrote to memory of 3948 2336 cmd.exe 73 PID 3948 wrote to memory of 1360 3948 cmd.exe 76 PID 3948 wrote to memory of 1360 3948 cmd.exe 76 PID 1360 wrote to memory of 1716 1360 ComputerDefaults.exe 77 PID 1360 wrote to memory of 1716 1360 ComputerDefaults.exe 77 PID 3948 wrote to memory of 1764 3948 cmd.exe 79 PID 3948 wrote to memory of 1764 3948 cmd.exe 79 PID 3948 wrote to memory of 1764 3948 cmd.exe 79 PID 1716 wrote to memory of 2008 1716 cmd.exe 80 PID 1716 wrote to memory of 2008 1716 cmd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\T49900783-Confirm-20220126-788088-Email-8700787.exe"C:\Users\Admin\AppData\Local\Temp\T49900783-Confirm-20220126-788088-Email-8700787.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵PID:2436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 3563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Contacts\Sawupcoqqrt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\Contacts\SawupcoqqrO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows \System32\ComputerDefaults.exe"C:\Windows \System32\ComputerDefaults.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""5⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 64⤵
- Runs ping.exe
PID:1764
-
-
-