Analysis
-
max time kernel
154s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 15:19
Static task
static1
Behavioral task
behavioral1
Sample
6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe
Resource
win10v2004-20220812-en
General
-
Target
6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe
-
Size
108KB
-
MD5
82cb127950bd78e3d111f3e1a56cd7cd
-
SHA1
6eeafd847d681f7ecd2d2a8b6e97d0a909c96ab1
-
SHA256
6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b
-
SHA512
c1810cd8c6061ecadfefb7c455e7645f80ed848d63ff5be89a2bd311887517f3c71dc3bcd2df88d2981fce5dd7da557f38b70044850f12be08134811c0d41b18
-
SSDEEP
1536:sWbEbt5nLgdnfeKDIy4jwBjZZN33ejz3VcP9EQv+K5NM9je5n:sWbEsn7Iy4ojt36zOOqHR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral2/memory/1868-138-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1868-139-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1868-144-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4936-151-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4936-152-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 4772 winvmsrv.exe 4936 winvmsrv.exe -
resource yara_rule behavioral2/memory/1868-135-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1868-137-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1868-138-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1868-139-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1868-144-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4936-150-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4936-151-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4936-152-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winvmsrv = "C:\\Users\\Admin\\AppData\\Roaming\\winvmsrv.exe" winvmsrv.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4088 set thread context of 1868 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 80 PID 4772 set thread context of 4936 4772 winvmsrv.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 4772 winvmsrv.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4088 wrote to memory of 1868 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 80 PID 4088 wrote to memory of 1868 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 80 PID 4088 wrote to memory of 1868 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 80 PID 4088 wrote to memory of 1868 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 80 PID 4088 wrote to memory of 1868 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 80 PID 4088 wrote to memory of 1868 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 80 PID 4088 wrote to memory of 1868 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 80 PID 4088 wrote to memory of 1868 4088 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 80 PID 1868 wrote to memory of 4772 1868 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 81 PID 1868 wrote to memory of 4772 1868 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 81 PID 1868 wrote to memory of 4772 1868 6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe 81 PID 4772 wrote to memory of 4936 4772 winvmsrv.exe 82 PID 4772 wrote to memory of 4936 4772 winvmsrv.exe 82 PID 4772 wrote to memory of 4936 4772 winvmsrv.exe 82 PID 4772 wrote to memory of 4936 4772 winvmsrv.exe 82 PID 4772 wrote to memory of 4936 4772 winvmsrv.exe 82 PID 4772 wrote to memory of 4936 4772 winvmsrv.exe 82 PID 4772 wrote to memory of 4936 4772 winvmsrv.exe 82 PID 4772 wrote to memory of 4936 4772 winvmsrv.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe"C:\Users\Admin\AppData\Local\Temp\6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe"C:\Users\Admin\AppData\Local\Temp\6dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Roaming\winvmsrv.exe"C:\Users\Admin\AppData\Roaming\winvmsrv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Roaming\winvmsrv.exe"C:\Users\Admin\AppData\Roaming\winvmsrv.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4936
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD582cb127950bd78e3d111f3e1a56cd7cd
SHA16eeafd847d681f7ecd2d2a8b6e97d0a909c96ab1
SHA2566dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b
SHA512c1810cd8c6061ecadfefb7c455e7645f80ed848d63ff5be89a2bd311887517f3c71dc3bcd2df88d2981fce5dd7da557f38b70044850f12be08134811c0d41b18
-
Filesize
108KB
MD582cb127950bd78e3d111f3e1a56cd7cd
SHA16eeafd847d681f7ecd2d2a8b6e97d0a909c96ab1
SHA2566dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b
SHA512c1810cd8c6061ecadfefb7c455e7645f80ed848d63ff5be89a2bd311887517f3c71dc3bcd2df88d2981fce5dd7da557f38b70044850f12be08134811c0d41b18
-
Filesize
108KB
MD582cb127950bd78e3d111f3e1a56cd7cd
SHA16eeafd847d681f7ecd2d2a8b6e97d0a909c96ab1
SHA2566dc472ca99051165d6cf2f2b0807380c60ef556f49835941e41f9f9fb183c05b
SHA512c1810cd8c6061ecadfefb7c455e7645f80ed848d63ff5be89a2bd311887517f3c71dc3bcd2df88d2981fce5dd7da557f38b70044850f12be08134811c0d41b18