Analysis
-
max time kernel
184s -
max time network
108s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 09:26
Static task
static1
Behavioral task
behavioral1
Sample
940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe
Resource
win10v2004-20221111-en
General
-
Target
940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe
-
Size
130KB
-
MD5
c025f4a90e28ab6fda40da5cd029a281
-
SHA1
9ae58932a63684613614a29ab5b8927f89c53739
-
SHA256
940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
-
SHA512
37cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
SSDEEP
3072:tnFnEqcTCJROHh+/VU7o/HGdKk0x3uy0rVX:tnFnEqcTCJROB+t0o/HM0xeht
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1336-59-0x00000000004082E8-mapping.dmp modiloader_stage2 behavioral1/memory/1336-58-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1336-64-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1640-77-0x00000000004082E8-mapping.dmp modiloader_stage2 behavioral1/memory/1640-99-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1640-101-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
SP3Patch.exeSP3Patch.exepid process 1048 SP3Patch.exe 1640 SP3Patch.exe -
Loads dropped DLL 8 IoCs
Processes:
940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exeSP3Patch.exeSP3Patch.exepid process 1336 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 1048 SP3Patch.exe 1048 SP3Patch.exe 1048 SP3Patch.exe 1048 SP3Patch.exe 1640 SP3Patch.exe 1640 SP3Patch.exe 1640 SP3Patch.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SP3Patch.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows SP 3 Service Pack = "C:\\Users\\Admin\\AppData\\Roaming\\SP3Patch.exe" SP3Patch.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exeSP3Patch.exedescription pid process target process PID 1188 set thread context of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 set thread context of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1048 set thread context of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 set thread context of 1640 1048 SP3Patch.exe SP3Patch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exeSP3Patch.exepid process 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 1048 SP3Patch.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exeSP3Patch.exedescription pid process target process PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1188 wrote to memory of 1336 1188 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe PID 1336 wrote to memory of 1048 1336 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe SP3Patch.exe PID 1336 wrote to memory of 1048 1336 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe SP3Patch.exe PID 1336 wrote to memory of 1048 1336 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe SP3Patch.exe PID 1336 wrote to memory of 1048 1336 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe SP3Patch.exe PID 1336 wrote to memory of 1048 1336 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe SP3Patch.exe PID 1336 wrote to memory of 1048 1336 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe SP3Patch.exe PID 1336 wrote to memory of 1048 1336 940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe PID 1048 wrote to memory of 1640 1048 SP3Patch.exe SP3Patch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe"C:\Users\Admin\AppData\Local\Temp\940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe"C:\Users\Admin\AppData\Local\Temp\940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Roaming\SP3Patch.exe"C:\Users\Admin\AppData\Roaming\SP3Patch.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Roaming\SP3Patch.exe"C:\Users\Admin\AppData\Roaming\SP3Patch.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
C:\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
C:\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
\Users\Admin\AppData\Roaming\SP3Patch.exeFilesize
130KB
MD5c025f4a90e28ab6fda40da5cd029a281
SHA19ae58932a63684613614a29ab5b8927f89c53739
SHA256940073f8271ebf8af00b1a805a635827fa9083123b571fce1acffca229b9e249
SHA51237cf8f441d16a500e849824c00b65af7a6ed28d85dcde7ab2207a94af0afa3ac7c185a0e6971902947bf84e87fbdad1d967358819ba6f25ddbb66f3f7abf8176
-
memory/1048-100-0x0000000000230000-0x0000000000251000-memory.dmpFilesize
132KB
-
memory/1048-98-0x0000000000230000-0x0000000000251000-memory.dmpFilesize
132KB
-
memory/1048-66-0x0000000000000000-mapping.dmp
-
memory/1188-57-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/1188-56-0x0000000075BE1000-0x0000000075BE3000-memory.dmpFilesize
8KB
-
memory/1336-59-0x00000000004082E8-mapping.dmp
-
memory/1336-63-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/1336-64-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1336-58-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1336-61-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/1640-91-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/1640-89-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/1640-82-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/1640-93-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/1640-95-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/1640-97-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/1640-87-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/1640-99-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1640-77-0x00000000004082E8-mapping.dmp
-
memory/1640-101-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB