Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 19:28
Static task
static1
Behavioral task
behavioral1
Sample
6036b574d93e0f406160cb2fd5ae636d.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
6036b574d93e0f406160cb2fd5ae636d.exe
Resource
win10v2004-20220721-en
General
-
Target
6036b574d93e0f406160cb2fd5ae636d.exe
-
Size
943KB
-
MD5
6036b574d93e0f406160cb2fd5ae636d
-
SHA1
bf7a1f488e36139f75e93458fd71f660cf7996e0
-
SHA256
0094a21cdba5b0d2622b2686f64dbcccf090675ae7ae86f21d4063ac1e17ccf9
-
SHA512
323fc3b7dc66c3557d4176605702bafd8a38b6a264b2969b2fbabcd9e99cccb5bc8461f67e45362addc13c4efc9f78015314988ac1a94241ed61f87d7dffef52
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 44 IoCs
Processes:
resource yara_rule behavioral1/memory/1824-58-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-59-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-60-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-61-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-62-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-63-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-64-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-65-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-66-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-67-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-68-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-69-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-72-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-71-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-70-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-73-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-74-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-75-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-76-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-77-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-78-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-79-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-85-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-86-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-87-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-88-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-89-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-90-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-92-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-93-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-94-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-95-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-96-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-97-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-98-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-99-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-100-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-101-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-102-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-103-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-104-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-105-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-106-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 behavioral1/memory/1824-108-0x0000000004890000-0x0000000004984000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6036b574d93e0f406160cb2fd5ae636d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ntjcbe = "C:\\Users\\Public\\Libraries\\ebcjtN.url" 6036b574d93e0f406160cb2fd5ae636d.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cleanmgr.exedescription ioc process File opened (read-only) \??\R: cleanmgr.exe File opened (read-only) \??\S: cleanmgr.exe File opened (read-only) \??\W: cleanmgr.exe File opened (read-only) \??\X: cleanmgr.exe File opened (read-only) \??\H: cleanmgr.exe File opened (read-only) \??\K: cleanmgr.exe File opened (read-only) \??\O: cleanmgr.exe File opened (read-only) \??\Q: cleanmgr.exe File opened (read-only) \??\Z: cleanmgr.exe File opened (read-only) \??\A: cleanmgr.exe File opened (read-only) \??\B: cleanmgr.exe File opened (read-only) \??\E: cleanmgr.exe File opened (read-only) \??\L: cleanmgr.exe File opened (read-only) \??\M: cleanmgr.exe File opened (read-only) \??\T: cleanmgr.exe File opened (read-only) \??\V: cleanmgr.exe File opened (read-only) \??\N: cleanmgr.exe File opened (read-only) \??\P: cleanmgr.exe File opened (read-only) \??\U: cleanmgr.exe File opened (read-only) \??\Y: cleanmgr.exe File opened (read-only) \??\F: cleanmgr.exe File opened (read-only) \??\G: cleanmgr.exe File opened (read-only) \??\I: cleanmgr.exe File opened (read-only) \??\J: cleanmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6036b574d93e0f406160cb2fd5ae636d.exepid process 1824 6036b574d93e0f406160cb2fd5ae636d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cleanmgr.exedescription pid process Token: SeShutdownPrivilege 1872 cleanmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
6036b574d93e0f406160cb2fd5ae636d.exedescription pid process target process PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe PID 1824 wrote to memory of 1872 1824 6036b574d93e0f406160cb2fd5ae636d.exe cleanmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6036b574d93e0f406160cb2fd5ae636d.exe"C:\Users\Admin\AppData\Local\Temp\6036b574d93e0f406160cb2fd5ae636d.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cleanmgr.exe"C:\Windows\System32\cleanmgr.exe"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1824-95-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-61-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-108-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-60-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-106-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-62-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-63-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-64-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-65-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-66-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-67-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-68-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-69-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-72-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-71-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-85-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-73-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-74-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-75-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-76-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-77-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-78-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-79-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-105-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-59-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-58-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-70-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-86-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-87-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-88-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-89-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-90-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-104-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-92-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-93-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-94-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-54-0x0000000075511000-0x0000000075513000-memory.dmpFilesize
8KB
-
memory/1824-96-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-97-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-98-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-99-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-100-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-101-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-102-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1824-103-0x0000000004890000-0x0000000004984000-memory.dmpFilesize
976KB
-
memory/1872-91-0x0000000050590000-0x0000000050617000-memory.dmpFilesize
540KB
-
memory/1872-80-0x0000000000000000-mapping.dmp
-
memory/1872-107-0x00000000037B0000-0x00000000043FA000-memory.dmpFilesize
12.3MB
-
memory/1872-83-0x0000000050590000-0x0000000050617000-memory.dmpFilesize
540KB
-
memory/1872-82-0x0000000070AA1000-0x0000000070AA3000-memory.dmpFilesize
8KB