Analysis
-
max time kernel
72s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 14:54
Static task
static1
Behavioral task
behavioral1
Sample
69b17d0f9389404a1228d310198b33e9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
69b17d0f9389404a1228d310198b33e9.exe
Resource
win10v2004-20220414-en
General
-
Target
69b17d0f9389404a1228d310198b33e9.exe
-
Size
2.9MB
-
MD5
69b17d0f9389404a1228d310198b33e9
-
SHA1
d70d61353e3ce850e6891623336ebdab931d5530
-
SHA256
28920de5f1a16d20eb01e17bee84c2144eefa938bf0653e4165e3ff18b9244cc
-
SHA512
6e4523f25ac22c39e3f942646ab85677cb65b367dc28e30d2e2cf69fe23692f160708afcfd9b31f3f85cae7f87eccd7c96a7fedcd30c23b0e768fd40b6012af8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
69b17d0f9389404a1228d310198b33e9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 69b17d0f9389404a1228d310198b33e9.exe -
ModiLoader Second Stage 39 IoCs
Processes:
resource yara_rule behavioral2/memory/2548-145-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-146-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-148-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-147-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-150-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-151-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-152-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-149-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-154-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-155-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-156-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-153-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-158-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-159-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-160-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-161-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-157-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-162-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-163-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-164-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-165-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-166-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-167-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-169-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-170-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-168-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-175-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-176-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-174-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-178-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-177-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-185-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-187-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-192-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-191-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-190-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-189-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-188-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 behavioral2/memory/2548-186-0x00000000054D0000-0x0000000005504000-memory.dmp modiloader_stage2 -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
69b17d0f9389404a1228d310198b33e9.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 69b17d0f9389404a1228d310198b33e9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 69b17d0f9389404a1228d310198b33e9.exe -
Processes:
resource yara_rule behavioral2/memory/2548-130-0x0000000000CF0000-0x0000000001402000-memory.dmp themida behavioral2/memory/2548-131-0x0000000000CF0000-0x0000000001402000-memory.dmp themida behavioral2/memory/2548-134-0x0000000000CF0000-0x0000000001402000-memory.dmp themida behavioral2/memory/2548-193-0x0000000000CF0000-0x0000000001402000-memory.dmp themida -
Processes:
69b17d0f9389404a1228d310198b33e9.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 69b17d0f9389404a1228d310198b33e9.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
69b17d0f9389404a1228d310198b33e9.exepid process 2548 69b17d0f9389404a1228d310198b33e9.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4856 1612 WerFault.exe 69b17d0f9389404a1228d310198b33e9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
69b17d0f9389404a1228d310198b33e9.exepid process 2548 69b17d0f9389404a1228d310198b33e9.exe 2548 69b17d0f9389404a1228d310198b33e9.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
69b17d0f9389404a1228d310198b33e9.exedescription pid process target process PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe PID 2548 wrote to memory of 1612 2548 69b17d0f9389404a1228d310198b33e9.exe 69b17d0f9389404a1228d310198b33e9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69b17d0f9389404a1228d310198b33e9.exe"C:\Users\Admin\AppData\Local\Temp\69b17d0f9389404a1228d310198b33e9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\69b17d0f9389404a1228d310198b33e9.exeC:\Users\Admin\AppData\Local\Temp\69b17d0f9389404a1228d310198b33e9.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1612 -ip 16121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1612-172-0x0000000000000000-mapping.dmp
-
memory/2548-164-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-190-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-134-0x0000000000CF0000-0x0000000001402000-memory.dmpFilesize
7.1MB
-
memory/2548-135-0x0000000077140000-0x00000000772E3000-memory.dmpFilesize
1.6MB
-
memory/2548-145-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-146-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-148-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-147-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-150-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-151-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-152-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-149-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-154-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-155-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-156-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-153-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-158-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-159-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-160-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-161-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-157-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-162-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-193-0x0000000000CF0000-0x0000000001402000-memory.dmpFilesize
7.1MB
-
memory/2548-132-0x0000000077140000-0x00000000772E3000-memory.dmpFilesize
1.6MB
-
memory/2548-169-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-166-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-167-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-165-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-170-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-168-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-131-0x0000000000CF0000-0x0000000001402000-memory.dmpFilesize
7.1MB
-
memory/2548-173-0x0000000010410000-0x0000000010421000-memory.dmpFilesize
68KB
-
memory/2548-175-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-176-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-174-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-178-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-177-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-185-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-187-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-192-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-191-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-130-0x0000000000CF0000-0x0000000001402000-memory.dmpFilesize
7.1MB
-
memory/2548-189-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-188-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-186-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-163-0x00000000054D0000-0x0000000005504000-memory.dmpFilesize
208KB
-
memory/2548-194-0x0000000077140000-0x00000000772E3000-memory.dmpFilesize
1.6MB