Analysis

  • max time kernel
    136s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    09-06-2022 06:28

General

  • Target

    15a259fc7995b7b4274962c8a8f872b5bce90d7986f69cfd75f6edc9ad7b7d01.exe

  • Size

    345KB

  • MD5

    0eec8a5b2725ec21b302b8df619a21b7

  • SHA1

    d1aeb0a628a0a724c70a9d856dffc8258596d3ca

  • SHA256

    15a259fc7995b7b4274962c8a8f872b5bce90d7986f69cfd75f6edc9ad7b7d01

  • SHA512

    9e1f3a0c5bc37cf922ae136e237720f53f8b045b844ac3368808275a50274308a3c10afdab1b59335f05c67f62a5cf0c2e6fbd70bf0425635590590bff609a27

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ModiLoader Second Stage 9 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15a259fc7995b7b4274962c8a8f872b5bce90d7986f69cfd75f6edc9ad7b7d01.exe
    "C:\Users\Admin\AppData\Local\Temp\15a259fc7995b7b4274962c8a8f872b5bce90d7986f69cfd75f6edc9ad7b7d01.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Users\Admin\AppData\Local\Temp\15a259fc7995b7b4274962c8a8f872b5bce90d7986f69cfd75f6edc9ad7b7d01.exe
      "C:\Users\Admin\AppData\Local\Temp\15a259fc7995b7b4274962c8a8f872b5bce90d7986f69cfd75f6edc9ad7b7d01.exe"
      2⤵
        PID:4448
    • C:\Windows\system32\mshta.exe
      "C:\Windows\system32\mshta.exe" javascript:tChnO7="2";L3n=new%20ActiveXObject("WScript.Shell");KATF0P7m="34R0mDhO";n1lHq=L3n.RegRead("HKCU\\software\\yyfYQPyL\\ahtKWT");xXW8iv8="PSb4WU";eval(n1lHq);vw9YK8="WXiTy";
      1⤵
      • Process spawned unexpected child process
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4516
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:tpnlwps
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:824

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/824-143-0x0000000000000000-mapping.dmp
    • memory/824-152-0x0000000006930000-0x000000000694A000-memory.dmp
      Filesize

      104KB

    • memory/824-151-0x0000000007D20000-0x000000000839A000-memory.dmp
      Filesize

      6.5MB

    • memory/824-149-0x0000000006430000-0x000000000644E000-memory.dmp
      Filesize

      120KB

    • memory/824-148-0x0000000005F10000-0x0000000005F76000-memory.dmp
      Filesize

      408KB

    • memory/824-147-0x0000000005EA0000-0x0000000005F06000-memory.dmp
      Filesize

      408KB

    • memory/824-146-0x0000000005680000-0x00000000056A2000-memory.dmp
      Filesize

      136KB

    • memory/824-145-0x0000000005870000-0x0000000005E98000-memory.dmp
      Filesize

      6.2MB

    • memory/824-144-0x0000000002D10000-0x0000000002D46000-memory.dmp
      Filesize

      216KB

    • memory/4448-135-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/4448-141-0x0000000000A10000-0x0000000000AEA000-memory.dmp
      Filesize

      872KB

    • memory/4448-139-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/4448-136-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/4448-130-0x0000000000000000-mapping.dmp
    • memory/4448-134-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/4448-150-0x0000000000A10000-0x0000000000AEA000-memory.dmp
      Filesize

      872KB

    • memory/4448-132-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/4448-131-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/4688-140-0x0000000002380000-0x0000000002537000-memory.dmp
      Filesize

      1.7MB