Overview

overview

10

Static

static

INVOICES.exe

windows7-x64

1

INVOICES.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    155s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-08-2022 21:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    INVOICES.exe

  • Size

    996KB

  • MD5

    edfc6e2add36e49c8c9e010db0eb0632

  • SHA1

    69697675cdc6d2c26db0709339bfd8f42044e7b6

  • SHA256

    86871dd03f2da6c6de34710060ddc726fae5907f1f48d37c26d23f4d3d3f9bb8

  • SHA512

    61dd86fe6c09ecb2e8e107a0aa6f93d0d44334f873c3fb4b842be5e4da26e72ad53cc65c202fe9aca0ef540021ed4ddbe4f3fa9030886d835ff6ad74c894cac6

Score
10/10
modiloaderpersistencetrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 45 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INVOICES.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICES.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      2⤵
        PID:2544

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/220-148-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-161-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-162-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-163-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-164-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-165-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-166-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-167-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-168-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-169-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-170-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-171-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-172-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-173-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-174-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-175-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-176-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-177-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-178-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-179-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-180-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-181-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-182-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-183-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-184-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-185-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-186-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-187-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-188-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-189-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-190-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-191-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-192-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-193-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-194-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-195-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-196-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-197-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-198-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-199-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-200-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-201-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-202-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-204-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/220-203-0x0000000003990000-0x0000000003A2F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/2544-205-0x0000000000000000-mapping.dmp
      Download