Analysis
-
max time kernel
150s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 03:48
Static task
static1
Behavioral task
behavioral1
Sample
835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe
Resource
win10v2004-20220812-en
General
-
Target
835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe
-
Size
314KB
-
MD5
494f779566dd1604344b8a9f931bfd8a
-
SHA1
5811a9dd688dbad8d2abebbe715791fc7086d766
-
SHA256
835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81
-
SHA512
9b39e5b1cd230eb0ab05e1786c7b3e3bbff06a3bcf1766b24461ebc08715d3709c4849f4ac69d199f2419d7df3089ff1e1e323b959056327f238a4c5de01a8f5
-
SSDEEP
6144:F3zDLbUUFEv5QOFaAPck2miZ+8K54S9G4zjOqlL1JGhwAPxU+O7H:eQKaAnDiZ+86E4HOibAbg
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
decrypted.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" decrypted.exe -
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\decrypted.exe modiloader_stage2 \Users\Admin\AppData\Local\Temp\decrypted.exe modiloader_stage2 C:\Users\Admin\AppData\Local\Temp\decrypted.exe modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
decrypted.exepid process 1780 decrypted.exe -
Loads dropped DLL 4 IoCs
Processes:
835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exedecrypted.exepid process 1360 835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe 1360 835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe 1780 decrypted.exe 1780 decrypted.exe -
Processes:
decrypted.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA decrypted.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" decrypted.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
decrypted.exedescription pid process Token: SeDebugPrivilege 1780 decrypted.exe Token: SeDebugPrivilege 1780 decrypted.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exedecrypted.exepid process 1360 835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe 1780 decrypted.exe 1780 decrypted.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exedescription pid process target process PID 1360 wrote to memory of 1780 1360 835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe decrypted.exe PID 1360 wrote to memory of 1780 1360 835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe decrypted.exe PID 1360 wrote to memory of 1780 1360 835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe decrypted.exe PID 1360 wrote to memory of 1780 1360 835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe decrypted.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
decrypted.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" decrypted.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe"C:\Users\Admin\AppData\Local\Temp\835a652ee8dc0143e2e581550212e8dac8b9cbdd36eef4e0151ebff8053adf81.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\decrypted.exe"C:\Users\Admin\AppData\Local\Temp\decrypted.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\decrypted.exeFilesize
270KB
MD5c188ea3e7111c0ff6ebec0db5c284390
SHA1df939150e6fcbb8aa74a6bd34b9643e189390cac
SHA2562409488206188b88f9b956aae55f9fb168874984dc5e33869955886b6332aeea
SHA512205948c9c0ef2af8046486777527cbd57141626f3df6831b28b11045a0a0acd8bb1c0a88d64f58ff15692728fcb191ff3e433b9416f50b60054a1c657666c8f8
-
\Users\Admin\AppData\Local\Temp\cmsetac.dllFilesize
32KB
MD53a529f4ac920574fa28575e331c8f8aa
SHA179dce39f757cc9f47a9d3be9fd49f653182807ac
SHA256d47d99a658033a9f2f5b993c876aa5e3e34aaac6a63b8e572cb86a240e9a432c
SHA512ad93f565e97409e367d9bcf09644bd9841713cde7c789c72aefbc8abadca61b67f505be8b3d4e21af305b413544fe6dfcc2e713684104071ae7333a0b46b0675
-
\Users\Admin\AppData\Local\Temp\decrypted.exeFilesize
270KB
MD5c188ea3e7111c0ff6ebec0db5c284390
SHA1df939150e6fcbb8aa74a6bd34b9643e189390cac
SHA2562409488206188b88f9b956aae55f9fb168874984dc5e33869955886b6332aeea
SHA512205948c9c0ef2af8046486777527cbd57141626f3df6831b28b11045a0a0acd8bb1c0a88d64f58ff15692728fcb191ff3e433b9416f50b60054a1c657666c8f8
-
\Users\Admin\AppData\Local\Temp\decrypted.exeFilesize
270KB
MD5c188ea3e7111c0ff6ebec0db5c284390
SHA1df939150e6fcbb8aa74a6bd34b9643e189390cac
SHA2562409488206188b88f9b956aae55f9fb168874984dc5e33869955886b6332aeea
SHA512205948c9c0ef2af8046486777527cbd57141626f3df6831b28b11045a0a0acd8bb1c0a88d64f58ff15692728fcb191ff3e433b9416f50b60054a1c657666c8f8
-
\Users\Admin\AppData\Local\Temp\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
memory/1360-56-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1780-59-0x0000000000000000-mapping.dmp
-
memory/1780-64-0x0000000000570000-0x000000000057E000-memory.dmpFilesize
56KB