Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 02:39
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.generic.ml.11693.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.generic.ml.11693.exe
Resource
win10v2004-20220414-en
General
-
Target
SecuriteInfo.com.generic.ml.11693.exe
-
Size
1.0MB
-
MD5
b7e7dbddbf21cffd9bc1c8dc94d4a441
-
SHA1
f224aa8a1b6fcc26c1ebce42166529191381abd5
-
SHA256
c8fc44d1f9bae45933ba95a20f0aebf0e69f8304ea11a4346e610dfacc8ce049
-
SHA512
72caa05fd9bb53057ecc0beb0a48505901c1d1f6d76394e3340f4ba9daaf472f95a760634a4943858821b41e2ae887f0ac76aa667c5d4fba72436f0d3f20dc67
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
ModiLoader Second Stage 38 IoCs
Processes:
resource yara_rule behavioral1/memory/1260-65-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-66-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-67-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-68-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-71-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-72-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-70-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-69-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-76-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-75-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-73-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-74-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-90-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-89-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-88-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-87-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-86-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-85-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-84-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-83-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-82-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-81-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-80-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-79-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-78-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-77-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-96-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-98-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-97-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-99-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-100-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-108-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-107-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-109-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-112-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-113-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-114-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 behavioral1/memory/1260-111-0x00000000042A0000-0x00000000042F3000-memory.dmp modiloader_stage2 -
Xloader Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1260-92-0x0000000010410000-0x000000001043C000-memory.dmp xloader behavioral1/memory/1356-95-0x0000000000000000-mapping.dmp xloader behavioral1/memory/1356-116-0x0000000010410000-0x000000001043C000-memory.dmp xloader behavioral1/memory/1356-124-0x0000000010410000-0x000000001043C000-memory.dmp xloader behavioral1/memory/364-128-0x0000000000090000-0x00000000000BC000-memory.dmp xloader behavioral1/memory/364-131-0x0000000000090000-0x00000000000BC000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
wuapp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wuapp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UR4TQRUH = "C:\\Program Files (x86)\\X-zbxdzix\\mfcopg.exe" wuapp.exe -
Loads dropped DLL 1 IoCs
Processes:
wuapp.exepid process 364 wuapp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
logagent.exewuapp.exedescription pid process target process PID 1356 set thread context of 1380 1356 logagent.exe Explorer.EXE PID 1356 set thread context of 1380 1356 logagent.exe Explorer.EXE PID 364 set thread context of 1380 364 wuapp.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
wuapp.exedescription ioc process File opened for modification C:\Program Files (x86)\X-zbxdzix\mfcopg.exe wuapp.exe -
Processes:
wuapp.exedescription ioc process Key created \Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
logagent.exewuapp.exepid process 1356 logagent.exe 1356 logagent.exe 1356 logagent.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
logagent.exewuapp.exepid process 1356 logagent.exe 1356 logagent.exe 1356 logagent.exe 1356 logagent.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe 364 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.exewuapp.exedescription pid process Token: SeDebugPrivilege 1356 logagent.exe Token: SeDebugPrivilege 364 wuapp.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
SecuriteInfo.com.generic.ml.11693.exeExplorer.EXEwuapp.exedescription pid process target process PID 1260 wrote to memory of 1356 1260 SecuriteInfo.com.generic.ml.11693.exe logagent.exe PID 1260 wrote to memory of 1356 1260 SecuriteInfo.com.generic.ml.11693.exe logagent.exe PID 1260 wrote to memory of 1356 1260 SecuriteInfo.com.generic.ml.11693.exe logagent.exe PID 1260 wrote to memory of 1356 1260 SecuriteInfo.com.generic.ml.11693.exe logagent.exe PID 1260 wrote to memory of 1356 1260 SecuriteInfo.com.generic.ml.11693.exe logagent.exe PID 1260 wrote to memory of 1356 1260 SecuriteInfo.com.generic.ml.11693.exe logagent.exe PID 1260 wrote to memory of 1356 1260 SecuriteInfo.com.generic.ml.11693.exe logagent.exe PID 1380 wrote to memory of 364 1380 Explorer.EXE wuapp.exe PID 1380 wrote to memory of 364 1380 Explorer.EXE wuapp.exe PID 1380 wrote to memory of 364 1380 Explorer.EXE wuapp.exe PID 1380 wrote to memory of 364 1380 Explorer.EXE wuapp.exe PID 1380 wrote to memory of 364 1380 Explorer.EXE wuapp.exe PID 1380 wrote to memory of 364 1380 Explorer.EXE wuapp.exe PID 1380 wrote to memory of 364 1380 Explorer.EXE wuapp.exe PID 364 wrote to memory of 896 364 wuapp.exe cmd.exe PID 364 wrote to memory of 896 364 wuapp.exe cmd.exe PID 364 wrote to memory of 896 364 wuapp.exe cmd.exe PID 364 wrote to memory of 896 364 wuapp.exe cmd.exe PID 364 wrote to memory of 1608 364 wuapp.exe Firefox.exe PID 364 wrote to memory of 1608 364 wuapp.exe Firefox.exe PID 364 wrote to memory of 1608 364 wuapp.exe Firefox.exe PID 364 wrote to memory of 1608 364 wuapp.exe Firefox.exe PID 364 wrote to memory of 1608 364 wuapp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.11693.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.11693.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
650KB
MD55c73e64374d9ba37ac5569d1f7de5c9b
SHA1592e26ffea429b30e0a648720b43739d2ff5e590
SHA2565d0a5018218dbc363909a7eb915a763863cfbcad6d1a6231eb20633d098d57c7
SHA512c0cfaf1bd497a799b3480a268bc4d2548d139f3f4b9f1ed41b09cd4c934d285b0ca36c1c3f45f8718feb50274bce1897939d0dfe612e26010c8bbaf004fe8905
-
memory/364-123-0x0000000000000000-mapping.dmp
-
memory/364-126-0x0000000000B90000-0x0000000000E93000-memory.dmpFilesize
3.0MB
-
memory/364-127-0x0000000001330000-0x000000000133B000-memory.dmpFilesize
44KB
-
memory/364-128-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB
-
memory/364-129-0x00000000004A0000-0x0000000000530000-memory.dmpFilesize
576KB
-
memory/364-131-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB
-
memory/896-125-0x0000000000000000-mapping.dmp
-
memory/1260-79-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-54-0x00000000753C1000-0x00000000753C3000-memory.dmpFilesize
8KB
-
memory/1260-75-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-73-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-74-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-90-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-89-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-88-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-87-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-86-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-85-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-84-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-83-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-82-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-81-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-80-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-69-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-78-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-77-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-76-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-92-0x0000000010410000-0x000000001043C000-memory.dmpFilesize
176KB
-
memory/1260-70-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-96-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-98-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-97-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-99-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-100-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-108-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-107-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-109-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-112-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-113-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-114-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-111-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-72-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-71-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-68-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-67-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-66-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1260-65-0x00000000042A0000-0x00000000042F3000-memory.dmpFilesize
332KB
-
memory/1356-93-0x0000000010410000-0x000000001043C000-memory.dmpFilesize
176KB
-
memory/1356-124-0x0000000010410000-0x000000001043C000-memory.dmpFilesize
176KB
-
memory/1356-121-0x0000000000310000-0x0000000000321000-memory.dmpFilesize
68KB
-
memory/1356-118-0x00000000002C0000-0x00000000002D1000-memory.dmpFilesize
68KB
-
memory/1356-117-0x0000000000B00000-0x0000000000E03000-memory.dmpFilesize
3.0MB
-
memory/1356-116-0x0000000010410000-0x000000001043C000-memory.dmpFilesize
176KB
-
memory/1356-95-0x0000000000000000-mapping.dmp
-
memory/1380-122-0x0000000006940000-0x0000000006A6A000-memory.dmpFilesize
1.2MB
-
memory/1380-119-0x00000000064E0000-0x0000000006609000-memory.dmpFilesize
1.2MB
-
memory/1380-130-0x0000000004EF0000-0x0000000004F8F000-memory.dmpFilesize
636KB
-
memory/1380-132-0x0000000004EF0000-0x0000000004F8F000-memory.dmpFilesize
636KB