Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 20:49
Static task
static1
Behavioral task
behavioral1
Sample
0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe
Resource
win10v2004-20220812-en
General
-
Target
0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe
-
Size
206KB
-
MD5
3ca892d1e448dd1ceff5490311ec8b5a
-
SHA1
a4ae6269fec4afadbff5394abbdd70d37e647870
-
SHA256
0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6
-
SHA512
f348e2ada958952c6d36e4e6e4179298613fe1c759e8d718cbfde20d2d539650a018424813a42c3d99158fa31dca58fa0abf133d8b27a7e2f87d38a62596984a
-
SSDEEP
3072:7C7fC3n5WSBNdT4hVDtsRDUoV4x2lbVv/spDflf6AWRMkx21lu34vu0ogM75a:76fundB3T4hVRsRUy62Z98DBVWelPsQ
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4304-137-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 behavioral2/memory/4304-138-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 behavioral2/memory/4304-139-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule behavioral2/memory/4304-133-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/4304-134-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/4304-136-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/4304-137-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/4304-138-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/4304-139-0x0000000000400000-0x000000000046F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe" 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exedescription pid process target process PID 5112 set thread context of 4304 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exepid process 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 4304 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exedescription pid process target process PID 5112 wrote to memory of 4304 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe PID 5112 wrote to memory of 4304 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe PID 5112 wrote to memory of 4304 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe PID 5112 wrote to memory of 4304 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe PID 5112 wrote to memory of 4304 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe PID 5112 wrote to memory of 4304 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe PID 5112 wrote to memory of 4304 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe PID 5112 wrote to memory of 4304 5112 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe 0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe"C:\Users\Admin\AppData\Local\Temp\0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exeC:\Users\Admin\AppData\Local\Temp\0199e82d3f02a40d5a25c9a3dca0fb859fa639e48b34f5b3851f2746cc6b34c6.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4304-132-0x0000000000000000-mapping.dmp
-
memory/4304-133-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/4304-134-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/4304-136-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/4304-137-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/4304-138-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/4304-139-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/5112-135-0x0000000000550000-0x0000000000554000-memory.dmpFilesize
16KB