Analysis
-
max time kernel
135s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 09:45
Behavioral task
behavioral1
Sample
ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe
Resource
win10v2004-20220812-en
General
-
Target
ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe
-
Size
704KB
-
MD5
e4fee3557c1b8c8993dad4ec141c0280
-
SHA1
899e8d0d601aed035868bd47ff1906fe85651880
-
SHA256
ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761
-
SHA512
19e9b9288930de8d1cf9e68a2dfa9ae97371fa1de9935100eaf98b4e84e0fb7c282b81feb79e786c2c27684d480b35aed8a05e01af3744c9b8139c1ff69874ff
-
SSDEEP
12288:L+Mh69k+tuyknwgTdytSsxPwkiicutZya3rX8Uq8d6MIDoKwbkFTul:hWVtunxkt9Pwf37e5/CpckFTM
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule \Program Files\Common Files\Microsoft Shared\MSInfo\free.exe modiloader_stage2 C:\Program Files\Common Files\Microsoft Shared\MSInfo\free.exe modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
free.exepid process 1288 free.exe -
Loads dropped DLL 1 IoCs
Processes:
ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exepid process 1304 ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\windows\CurrentVersion\Run ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\free = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\free.exe\"" ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe -
Drops file in Program Files directory 2 IoCs
Processes:
ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\free.exe ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\free.exe ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
free.exedescription pid process Token: SeIncBasePriorityPrivilege 1288 free.exe Token: SeIncBasePriorityPrivilege 1288 free.exe Token: SeIncBasePriorityPrivilege 1288 free.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exedescription pid process target process PID 1304 wrote to memory of 1288 1304 ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe free.exe PID 1304 wrote to memory of 1288 1304 ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe free.exe PID 1304 wrote to memory of 1288 1304 ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe free.exe PID 1304 wrote to memory of 1288 1304 ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe free.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe"C:\Users\Admin\AppData\Local\Temp\ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\free.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\free.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\free.exeFilesize
704KB
MD5e4fee3557c1b8c8993dad4ec141c0280
SHA1899e8d0d601aed035868bd47ff1906fe85651880
SHA256ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761
SHA51219e9b9288930de8d1cf9e68a2dfa9ae97371fa1de9935100eaf98b4e84e0fb7c282b81feb79e786c2c27684d480b35aed8a05e01af3744c9b8139c1ff69874ff
-
\Program Files\Common Files\Microsoft Shared\MSInfo\free.exeFilesize
704KB
MD5e4fee3557c1b8c8993dad4ec141c0280
SHA1899e8d0d601aed035868bd47ff1906fe85651880
SHA256ed9f5bfdf66779e7e58382a733134e00ec8cee48a6bbf8b45828bc6c2ecde761
SHA51219e9b9288930de8d1cf9e68a2dfa9ae97371fa1de9935100eaf98b4e84e0fb7c282b81feb79e786c2c27684d480b35aed8a05e01af3744c9b8139c1ff69874ff
-
memory/1288-56-0x0000000000000000-mapping.dmp
-
memory/1304-54-0x00000000762E1000-0x00000000762E3000-memory.dmpFilesize
8KB