Analysis
-
max time kernel
204s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 00:16
Static task
static1
Behavioral task
behavioral1
Sample
2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe
Resource
win10v2004-20221111-en
General
-
Target
2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe
-
Size
348KB
-
MD5
e8e241226dbaedb679b3d460fa347d07
-
SHA1
c0e193184cc3425a816797567484df2923b73c1a
-
SHA256
2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080
-
SHA512
b5dc08603a21091b14591f2840daea94e6ef9d2ca39cd68ddc1597b1536b9d7af2d76229fe20809772a01e5fa44d009f6cc5d974fd0da357b7f67c963faba577
-
SSDEEP
6144:9QM1JNEHkOHHb/xKv3huj63yTVn3LRvO+S6f7bUtuh:uOJNUkOcYjag3hO+S6f7b/
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FolderName\\file.exe" reg.exe -
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2980-147-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4312-149-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
tmp.exeAdobeART.exepid process 2980 tmp.exe 4312 AdobeART.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\tmp.exe upx C:\Users\Admin\AppData\Local\Temp\tmp.exe upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx behavioral2/memory/2980-147-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4312-149-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exe2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exetmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation tmp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exepid process 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exedescription pid process Token: SeDebugPrivilege 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe Token: 33 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe Token: SeIncBasePriorityPrivilege 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.execmd.exewscript.execmd.exetmp.exedescription pid process target process PID 648 wrote to memory of 3888 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe cmd.exe PID 648 wrote to memory of 3888 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe cmd.exe PID 648 wrote to memory of 3888 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe cmd.exe PID 3888 wrote to memory of 2284 3888 cmd.exe wscript.exe PID 3888 wrote to memory of 2284 3888 cmd.exe wscript.exe PID 3888 wrote to memory of 2284 3888 cmd.exe wscript.exe PID 2284 wrote to memory of 1248 2284 wscript.exe cmd.exe PID 2284 wrote to memory of 1248 2284 wscript.exe cmd.exe PID 2284 wrote to memory of 1248 2284 wscript.exe cmd.exe PID 648 wrote to memory of 2980 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe tmp.exe PID 648 wrote to memory of 2980 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe tmp.exe PID 648 wrote to memory of 2980 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe tmp.exe PID 648 wrote to memory of 8 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe .exe PID 648 wrote to memory of 8 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe .exe PID 648 wrote to memory of 8 648 2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe .exe PID 1248 wrote to memory of 1724 1248 cmd.exe reg.exe PID 1248 wrote to memory of 1724 1248 cmd.exe reg.exe PID 1248 wrote to memory of 1724 1248 cmd.exe reg.exe PID 2980 wrote to memory of 4312 2980 tmp.exe AdobeART.exe PID 2980 wrote to memory of 4312 2980 tmp.exe AdobeART.exe PID 2980 wrote to memory of 4312 2980 tmp.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe"C:\Users\Admin\AppData\Local\Temp\2bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderName\mata.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderName\file.exe" /f5⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\.exeC:\Users\Admin\AppData\Local\Temp\.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderName\file.exeFilesize
348KB
MD5e8e241226dbaedb679b3d460fa347d07
SHA1c0e193184cc3425a816797567484df2923b73c1a
SHA2562bf25cedadf332c7c704b35eebd78182f8f35b85d77a110dfb62c7761ab81080
SHA512b5dc08603a21091b14591f2840daea94e6ef9d2ca39cd68ddc1597b1536b9d7af2d76229fe20809772a01e5fa44d009f6cc5d974fd0da357b7f67c963faba577
-
C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\FolderName\mata.batFilesize
70B
MD523f72401196919748c14cb64c1d55c3b
SHA1869e3809cb4391e6f5aee5349a871e40a1e1fb22
SHA256d09c4054568f89c5de2bd9bae9cbcbcb3ef2dda9a9ded0153e29da26dc405d11
SHA5122ab844717c31c4819d8773d7604dfc831e950ae9e38fe311acf8178d46f39fafb54b448ebb6b9cf5d1edd47ed36eae11d649c1be346b0a35d380dd07101c79f1
-
C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.batFilesize
264B
MD597dfcf34d96b3587305d76f1341ee47a
SHA1fb23bb7801ea88f843f34c4c5dd06b8cdde79bad
SHA256c739644b2cbc2a4b14049df16434ea85d14ce0898079f21d509f24973c6f5f0b
SHA512285275c3eadcebd2ca2a116c5b691a56d9748340f4327b13b74bf7a9873f5ce8fa75e7d7cb30ed7186525a11aac7beff88dff39fac8a70f454eb4fc16d63520a
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
18KB
MD5ab4edd31c6822842b2187a9042a58523
SHA1c330f2160fa0c8b373322c154faffdd058364031
SHA256f70efbef06ab6384bbf3550109cc0db3ba68791d1534763c7389d7f2c37bdf73
SHA512423eca1f366b3904a30e32083adba30a77d23cd3cbe1374fff7097f8910daf75b45afa14671f7a60be9e3d385a492c9fce765341c1e4667279b058dd74162a34
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
18KB
MD5ab4edd31c6822842b2187a9042a58523
SHA1c330f2160fa0c8b373322c154faffdd058364031
SHA256f70efbef06ab6384bbf3550109cc0db3ba68791d1534763c7389d7f2c37bdf73
SHA512423eca1f366b3904a30e32083adba30a77d23cd3cbe1374fff7097f8910daf75b45afa14671f7a60be9e3d385a492c9fce765341c1e4667279b058dd74162a34
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
18KB
MD5ab4edd31c6822842b2187a9042a58523
SHA1c330f2160fa0c8b373322c154faffdd058364031
SHA256f70efbef06ab6384bbf3550109cc0db3ba68791d1534763c7389d7f2c37bdf73
SHA512423eca1f366b3904a30e32083adba30a77d23cd3cbe1374fff7097f8910daf75b45afa14671f7a60be9e3d385a492c9fce765341c1e4667279b058dd74162a34
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
18KB
MD5ab4edd31c6822842b2187a9042a58523
SHA1c330f2160fa0c8b373322c154faffdd058364031
SHA256f70efbef06ab6384bbf3550109cc0db3ba68791d1534763c7389d7f2c37bdf73
SHA512423eca1f366b3904a30e32083adba30a77d23cd3cbe1374fff7097f8910daf75b45afa14671f7a60be9e3d385a492c9fce765341c1e4667279b058dd74162a34
-
memory/8-143-0x0000000000000000-mapping.dmp
-
memory/648-132-0x0000000075270000-0x0000000075821000-memory.dmpFilesize
5.7MB
-
memory/648-133-0x0000000075270000-0x0000000075821000-memory.dmpFilesize
5.7MB
-
memory/648-151-0x0000000075270000-0x0000000075821000-memory.dmpFilesize
5.7MB
-
memory/1248-139-0x0000000000000000-mapping.dmp
-
memory/1724-144-0x0000000000000000-mapping.dmp
-
memory/2284-136-0x0000000000000000-mapping.dmp
-
memory/2980-140-0x0000000000000000-mapping.dmp
-
memory/2980-147-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3888-134-0x0000000000000000-mapping.dmp
-
memory/4312-145-0x0000000000000000-mapping.dmp
-
memory/4312-149-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB