Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-09-2022 09:14
Behavioral task
behavioral1
Sample
136633e5ae4f13410bac27584c3108d0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
136633e5ae4f13410bac27584c3108d0.exe
Resource
win10v2004-20220812-en
General
-
Target
136633e5ae4f13410bac27584c3108d0.exe
-
Size
37KB
-
MD5
136633e5ae4f13410bac27584c3108d0
-
SHA1
58c72d9cc3c79877feb6946da1584e448c8791b6
-
SHA256
a9ddc02db6ca7df77bc719734f029da5b818604873f0bc7cef9664fdce1e7326
-
SHA512
7c5267a23b2d9bba779dec3465c76df5e3a89f1f933f9644bccce0245b80b03e08db3639d63b90cb440c7e9f45072eea9d95d4815cf5c62668c5f69b17ca8c83
-
SSDEEP
384:LalqiU154NLHdayszHtyPpzsobO7krAF+rMRTyN/0L+EcoinblneHQM3epzX1Nr9:u/ZdJszHtyxVOIrM+rMRa8NurVt
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\tmp198A.tmp.exe modiloader_stage2 \Users\Admin\AppData\Local\Temp\tmp198A.tmp.exe modiloader_stage2 C:\Users\Admin\AppData\Local\Temp\tmp198A.tmp.exe modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
tmp198A.tmp.exepid process 1160 tmp198A.tmp.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
136633e5ae4f13410bac27584c3108d0.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2bc9c3501521d589c5326debb3744676.exe 136633e5ae4f13410bac27584c3108d0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2bc9c3501521d589c5326debb3744676.exe 136633e5ae4f13410bac27584c3108d0.exe -
Loads dropped DLL 1 IoCs
Processes:
136633e5ae4f13410bac27584c3108d0.exepid process 1672 136633e5ae4f13410bac27584c3108d0.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
136633e5ae4f13410bac27584c3108d0.exetmp198A.tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\2bc9c3501521d589c5326debb3744676 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\136633e5ae4f13410bac27584c3108d0.exe\" .." 136633e5ae4f13410bac27584c3108d0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2bc9c3501521d589c5326debb3744676 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\136633e5ae4f13410bac27584c3108d0.exe\" .." 136633e5ae4f13410bac27584c3108d0.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run tmp198A.tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tmp198A.tmp.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp198A.tmp.exe" tmp198A.tmp.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
136633e5ae4f13410bac27584c3108d0.exedescription ioc process File opened for modification C:\autorun.inf 136633e5ae4f13410bac27584c3108d0.exe File created D:\autorun.inf 136633e5ae4f13410bac27584c3108d0.exe File created C:\autorun.inf 136633e5ae4f13410bac27584c3108d0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
136633e5ae4f13410bac27584c3108d0.exepid process 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe 1672 136633e5ae4f13410bac27584c3108d0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
136633e5ae4f13410bac27584c3108d0.exepid process 1672 136633e5ae4f13410bac27584c3108d0.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
136633e5ae4f13410bac27584c3108d0.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeShutdownPrivilege 1296 explorer.exe Token: 33 1672 136633e5ae4f13410bac27584c3108d0.exe Token: SeIncBasePriorityPrivilege 1672 136633e5ae4f13410bac27584c3108d0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
136633e5ae4f13410bac27584c3108d0.exedescription pid process target process PID 1672 wrote to memory of 1552 1672 136633e5ae4f13410bac27584c3108d0.exe netsh.exe PID 1672 wrote to memory of 1552 1672 136633e5ae4f13410bac27584c3108d0.exe netsh.exe PID 1672 wrote to memory of 1552 1672 136633e5ae4f13410bac27584c3108d0.exe netsh.exe PID 1672 wrote to memory of 1552 1672 136633e5ae4f13410bac27584c3108d0.exe netsh.exe PID 1672 wrote to memory of 1160 1672 136633e5ae4f13410bac27584c3108d0.exe tmp198A.tmp.exe PID 1672 wrote to memory of 1160 1672 136633e5ae4f13410bac27584c3108d0.exe tmp198A.tmp.exe PID 1672 wrote to memory of 1160 1672 136633e5ae4f13410bac27584c3108d0.exe tmp198A.tmp.exe PID 1672 wrote to memory of 1160 1672 136633e5ae4f13410bac27584c3108d0.exe tmp198A.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\136633e5ae4f13410bac27584c3108d0.exe"C:\Users\Admin\AppData\Local\Temp\136633e5ae4f13410bac27584c3108d0.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\136633e5ae4f13410bac27584c3108d0.exe" "136633e5ae4f13410bac27584c3108d0.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\Temp\tmp198A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp198A.tmp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp198A.tmp.exeFilesize
397KB
MD56f701d5889646a339ac4c5e316a46c3d
SHA19abc968718e4b8949727d403cf0b30313a7eca08
SHA25654659e9800902c3809e5d9474a03ff1b756781b4ba1aad666dfd8bb5976eb7a2
SHA51246864b0e9f6e81d700830a8ce305462098a549a3d962b799b3abd36cdf7594789f4c1b75322e4279f2f36ae3cc4df344ef98b52da945ada38ecab60764f81ba1
-
C:\Users\Admin\AppData\Local\Temp\tmp198A.tmp.exeFilesize
397KB
MD56f701d5889646a339ac4c5e316a46c3d
SHA19abc968718e4b8949727d403cf0b30313a7eca08
SHA25654659e9800902c3809e5d9474a03ff1b756781b4ba1aad666dfd8bb5976eb7a2
SHA51246864b0e9f6e81d700830a8ce305462098a549a3d962b799b3abd36cdf7594789f4c1b75322e4279f2f36ae3cc4df344ef98b52da945ada38ecab60764f81ba1
-
\Users\Admin\AppData\Local\Temp\tmp198A.tmp.exeFilesize
397KB
MD56f701d5889646a339ac4c5e316a46c3d
SHA19abc968718e4b8949727d403cf0b30313a7eca08
SHA25654659e9800902c3809e5d9474a03ff1b756781b4ba1aad666dfd8bb5976eb7a2
SHA51246864b0e9f6e81d700830a8ce305462098a549a3d962b799b3abd36cdf7594789f4c1b75322e4279f2f36ae3cc4df344ef98b52da945ada38ecab60764f81ba1
-
memory/1160-60-0x0000000000000000-mapping.dmp
-
memory/1296-64-0x000007FEFB191000-0x000007FEFB193000-memory.dmpFilesize
8KB
-
memory/1552-56-0x0000000000000000-mapping.dmp
-
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB
-
memory/1672-55-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB
-
memory/1672-58-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB