General
Target

dfc36d52a5d7bd9edfa69f71a68d82c88cb5807a921c0f3728f76b31ed404e45.exe

Filesize

352KB

Completed

21-05-2022 13:12

Task

behavioral2

Score
10/10
MD5

5838fdd9a6d593e38d858fb0b4dc198b

SHA1

214ffb0080ff13a439d7a73ca1944677159cdf11

SHA256

dfc36d52a5d7bd9edfa69f71a68d82c88cb5807a921c0f3728f76b31ed404e45

SHA256

079d141b63e2d793bc052c600e6b9626a1bf0f2c28b384abf30ea327d01680144246522fe9cf03057f6662ed87ce38f814d872acda65d8b3b769d7204355d6fb

Malware Config
Signatures 8

Filter: none

Discovery
  • ModiLoader, DBatLoader

    Description

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Process spawned unexpected child process
    mshta.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process42524100mshta.exe
  • ModiLoader Second Stage

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/1948-130-0x0000000000400000-0x000000000043C000-memory.dmpmodiloader_stage2
    behavioral2/memory/1948-131-0x0000000000400000-0x000000000045EAB0-memory.dmpmodiloader_stage2
    behavioral2/memory/1948-132-0x0000000000400000-0x000000000045EAB0-memory.dmpmodiloader_stage2
    behavioral2/memory/1948-133-0x0000000000740000-0x000000000081C000-memory.dmpmodiloader_stage2
  • Checks computer location settings
    mshta.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nationmshta.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: EnumeratesProcesses
    powershell.exe

    Reported IOCs

    pidprocess
    1644powershell.exe
    1644powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    powershell.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1644powershell.exe
  • Suspicious use of WriteProcessMemory
    mshta.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4252 wrote to memory of 16444252mshta.exepowershell.exe
    PID 4252 wrote to memory of 16444252mshta.exepowershell.exe
    PID 4252 wrote to memory of 16444252mshta.exepowershell.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\dfc36d52a5d7bd9edfa69f71a68d82c88cb5807a921c0f3728f76b31ed404e45.exe
    "C:\Users\Admin\AppData\Local\Temp\dfc36d52a5d7bd9edfa69f71a68d82c88cb5807a921c0f3728f76b31ed404e45.exe"
    PID:1948
  • C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" javascript:hYgqg7I="zA4q2SzP";W04D=new%20ActiveXObject("WScript.Shell");A25kPbA="AWbO";Dk9Wi=W04D.RegRead("HKCU\\software\\hLBZgVuW\\0YQvvnf");Bfe47Yl="6tngfEmZ";eval(Dk9Wi);E5f0kqP="qh4TxR";
    Process spawned unexpected child process
    Checks computer location settings
    Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:hlfjhp
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1644
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/1644-143-0x0000000006D80000-0x0000000006D9A000-memory.dmp

                        • memory/1644-142-0x00000000080F0000-0x000000000876A000-memory.dmp

                        • memory/1644-141-0x00000000068D0000-0x00000000068EE000-memory.dmp

                        • memory/1644-140-0x00000000062D0000-0x0000000006336000-memory.dmp

                        • memory/1644-135-0x0000000000000000-mapping.dmp

                        • memory/1644-136-0x0000000005510000-0x0000000005546000-memory.dmp

                        • memory/1644-137-0x0000000005BF0000-0x0000000006218000-memory.dmp

                        • memory/1644-138-0x0000000005AE0000-0x0000000005B02000-memory.dmp

                        • memory/1644-139-0x0000000005B80000-0x0000000005BE6000-memory.dmp

                        • memory/1948-133-0x0000000000740000-0x000000000081C000-memory.dmp

                        • memory/1948-132-0x0000000000400000-0x000000000045EAB0-memory.dmp

                        • memory/1948-131-0x0000000000400000-0x000000000045EAB0-memory.dmp

                        • memory/1948-130-0x0000000000400000-0x000000000043C000-memory.dmp