Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 15:13
Static task
static1
Behavioral task
behavioral1
Sample
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe
Resource
win10v2004-20221111-en
General
-
Target
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe
-
Size
441KB
-
MD5
248d93c80c5c4eb6c9294ad7d83c1afc
-
SHA1
f2a934566c9c07afe26cb9d6147dbee3e9e5493e
-
SHA256
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
-
SHA512
8d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
SSDEEP
3072:WfNkW+exbiDypkGYhnPypkGYhnCFGbB/B7jWlyAKjaZDG7R1BkANIBWftz/tvvCJ:WFkWpmhnapmhn17R1BkAsWh/KydvSuK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral1/memory/700-66-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/700-71-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/2020-85-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/2020-86-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
bsbdejdnlwbrlkj.exebsbdejdnlwbrlkj.exepid process 576 bsbdejdnlwbrlkj.exe 2020 bsbdejdnlwbrlkj.exe -
Processes:
resource yara_rule behavioral1/memory/700-57-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/700-59-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/700-60-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/700-64-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/700-65-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/700-66-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/700-71-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2020-84-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2020-85-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2020-86-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exepid process 700 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe 700 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bsbdejdnlwbrlkj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\bsbdejdnlwbrlkj.exe" bsbdejdnlwbrlkj.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exebsbdejdnlwbrlkj.exedescription pid process target process PID 1116 set thread context of 700 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 576 set thread context of 2020 576 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exebsbdejdnlwbrlkj.exepid process 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe 576 bsbdejdnlwbrlkj.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exee514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exebsbdejdnlwbrlkj.exedescription pid process target process PID 1116 wrote to memory of 700 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 1116 wrote to memory of 700 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 1116 wrote to memory of 700 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 1116 wrote to memory of 700 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 1116 wrote to memory of 700 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 1116 wrote to memory of 700 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 1116 wrote to memory of 700 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 1116 wrote to memory of 700 1116 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 700 wrote to memory of 576 700 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe bsbdejdnlwbrlkj.exe PID 700 wrote to memory of 576 700 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe bsbdejdnlwbrlkj.exe PID 700 wrote to memory of 576 700 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe bsbdejdnlwbrlkj.exe PID 700 wrote to memory of 576 700 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe bsbdejdnlwbrlkj.exe PID 576 wrote to memory of 2020 576 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 576 wrote to memory of 2020 576 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 576 wrote to memory of 2020 576 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 576 wrote to memory of 2020 576 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 576 wrote to memory of 2020 576 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 576 wrote to memory of 2020 576 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 576 wrote to memory of 2020 576 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 576 wrote to memory of 2020 576 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe"C:\Users\Admin\AppData\Local\Temp\e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe"C:\Users\Admin\AppData\Local\Temp\e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exe"C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exe"C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exeFilesize
441KB
MD5248d93c80c5c4eb6c9294ad7d83c1afc
SHA1f2a934566c9c07afe26cb9d6147dbee3e9e5493e
SHA256e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
SHA5128d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exeFilesize
441KB
MD5248d93c80c5c4eb6c9294ad7d83c1afc
SHA1f2a934566c9c07afe26cb9d6147dbee3e9e5493e
SHA256e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
SHA5128d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exeFilesize
441KB
MD5248d93c80c5c4eb6c9294ad7d83c1afc
SHA1f2a934566c9c07afe26cb9d6147dbee3e9e5493e
SHA256e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
SHA5128d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exeFilesize
441KB
MD5248d93c80c5c4eb6c9294ad7d83c1afc
SHA1f2a934566c9c07afe26cb9d6147dbee3e9e5493e
SHA256e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
SHA5128d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exeFilesize
441KB
MD5248d93c80c5c4eb6c9294ad7d83c1afc
SHA1f2a934566c9c07afe26cb9d6147dbee3e9e5493e
SHA256e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
SHA5128d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
memory/576-69-0x0000000000000000-mapping.dmp
-
memory/700-71-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/700-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/700-66-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/700-64-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/700-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/700-63-0x0000000076381000-0x0000000076383000-memory.dmpFilesize
8KB
-
memory/700-61-0x0000000000412D30-mapping.dmp
-
memory/700-65-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/700-59-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/700-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2020-80-0x0000000000412D30-mapping.dmp
-
memory/2020-84-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2020-85-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2020-86-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB