Analysis
-
max time kernel
165s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 14:35
Static task
static1
Behavioral task
behavioral1
Sample
18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exe
Resource
win10v2004-20221111-en
General
-
Target
18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exe
-
Size
46KB
-
MD5
7514e9572b994ad987d547e0a3672ca5
-
SHA1
a85e1ef59af31f8616f771608d6d273113742dcb
-
SHA256
18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63
-
SHA512
c314865e54eb6f769c57e9c2d27cc9d69395817fa86382e49298830e2f75d9496a7f51c64cbd22d310b5594fd1d89c6e0d25d0e45641a5f09e41a6469b2bd493
-
SSDEEP
768:pNzKbq5GTVQR5mcFhBHMEJSi7nb0N5iBdDbJ9ddukoNwTrx7IUJHterTO4hUnQG:pNgqksZ/7b0LiPJluko6TtbHtShUnQG
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3876-139-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/5028-143-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
New.exeAdobeART.exepid process 3876 New.exe 5028 AdobeART.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\New.exe upx C:\Users\Admin\AppData\Local\Temp\New.exe upx behavioral2/memory/3876-138-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3876-139-0x0000000000400000-0x0000000000414000-memory.dmp upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx behavioral2/memory/5028-143-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exeNew.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation New.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exeNew.exedescription pid process target process PID 4336 wrote to memory of 3876 4336 18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exe New.exe PID 4336 wrote to memory of 3876 4336 18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exe New.exe PID 4336 wrote to memory of 3876 4336 18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exe New.exe PID 3876 wrote to memory of 5028 3876 New.exe AdobeART.exe PID 3876 wrote to memory of 5028 3876 New.exe AdobeART.exe PID 3876 wrote to memory of 5028 3876 New.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exe"C:\Users\Admin\AppData\Local\Temp\18511c5d126bd11751b10296a92e9752cadbf243d3adcab964ea16a4e2580a63.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\New.exe"C:\Users\Admin\AppData\Local\Temp\New.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\New.exeFilesize
18KB
MD599bd5d2b9966922357b7046cb47ba4a8
SHA14574a5746df665c472e4ad3c9cc994e5714d85d0
SHA256696f1311620d270283347cc05d39147241fb4178ce6dcbb609600fa859de91cc
SHA5126773346ebb1032c083d1dc9aad60b6a9d89aa7c9780ca1efba522f3678b5ae38fde38beb20abd5ec717d60923f7572d21ae4c65f72c6f357dacc78c82a7e023f
-
C:\Users\Admin\AppData\Local\Temp\New.exeFilesize
18KB
MD599bd5d2b9966922357b7046cb47ba4a8
SHA14574a5746df665c472e4ad3c9cc994e5714d85d0
SHA256696f1311620d270283347cc05d39147241fb4178ce6dcbb609600fa859de91cc
SHA5126773346ebb1032c083d1dc9aad60b6a9d89aa7c9780ca1efba522f3678b5ae38fde38beb20abd5ec717d60923f7572d21ae4c65f72c6f357dacc78c82a7e023f
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
18KB
MD599bd5d2b9966922357b7046cb47ba4a8
SHA14574a5746df665c472e4ad3c9cc994e5714d85d0
SHA256696f1311620d270283347cc05d39147241fb4178ce6dcbb609600fa859de91cc
SHA5126773346ebb1032c083d1dc9aad60b6a9d89aa7c9780ca1efba522f3678b5ae38fde38beb20abd5ec717d60923f7572d21ae4c65f72c6f357dacc78c82a7e023f
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
18KB
MD599bd5d2b9966922357b7046cb47ba4a8
SHA14574a5746df665c472e4ad3c9cc994e5714d85d0
SHA256696f1311620d270283347cc05d39147241fb4178ce6dcbb609600fa859de91cc
SHA5126773346ebb1032c083d1dc9aad60b6a9d89aa7c9780ca1efba522f3678b5ae38fde38beb20abd5ec717d60923f7572d21ae4c65f72c6f357dacc78c82a7e023f
-
memory/3876-134-0x0000000000000000-mapping.dmp
-
memory/3876-138-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3876-139-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4336-132-0x00000000754C0000-0x0000000075A71000-memory.dmpFilesize
5.7MB
-
memory/4336-133-0x00000000754C0000-0x0000000075A71000-memory.dmpFilesize
5.7MB
-
memory/4336-137-0x00000000754C0000-0x0000000075A71000-memory.dmpFilesize
5.7MB
-
memory/5028-140-0x0000000000000000-mapping.dmp
-
memory/5028-143-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB