Analysis
-
max time kernel
190s -
max time network
231s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 15:13
Static task
static1
Behavioral task
behavioral1
Sample
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe
Resource
win10v2004-20221111-en
General
-
Target
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe
-
Size
441KB
-
MD5
248d93c80c5c4eb6c9294ad7d83c1afc
-
SHA1
f2a934566c9c07afe26cb9d6147dbee3e9e5493e
-
SHA256
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
-
SHA512
8d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
SSDEEP
3072:WfNkW+exbiDypkGYhnPypkGYhnCFGbB/B7jWlyAKjaZDG7R1BkANIBWftz/tvvCJ:WFkWpmhnapmhn17R1BkAsWh/KydvSuK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3476-138-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3476-139-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3476-144-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1600-151-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1600-152-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
bsbdejdnlwbrlkj.exebsbdejdnlwbrlkj.exepid process 3652 bsbdejdnlwbrlkj.exe 1600 bsbdejdnlwbrlkj.exe -
Processes:
resource yara_rule behavioral2/memory/3476-135-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3476-137-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3476-138-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3476-139-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3476-144-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1600-150-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1600-151-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1600-152-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bsbdejdnlwbrlkj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\bsbdejdnlwbrlkj.exe" bsbdejdnlwbrlkj.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exebsbdejdnlwbrlkj.exedescription pid process target process PID 748 set thread context of 3476 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 3652 set thread context of 1600 3652 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exebsbdejdnlwbrlkj.exepid process 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe 3652 bsbdejdnlwbrlkj.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exee514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exebsbdejdnlwbrlkj.exedescription pid process target process PID 748 wrote to memory of 3476 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 748 wrote to memory of 3476 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 748 wrote to memory of 3476 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 748 wrote to memory of 3476 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 748 wrote to memory of 3476 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 748 wrote to memory of 3476 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 748 wrote to memory of 3476 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 748 wrote to memory of 3476 748 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe PID 3476 wrote to memory of 3652 3476 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe bsbdejdnlwbrlkj.exe PID 3476 wrote to memory of 3652 3476 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe bsbdejdnlwbrlkj.exe PID 3476 wrote to memory of 3652 3476 e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe bsbdejdnlwbrlkj.exe PID 3652 wrote to memory of 1600 3652 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 3652 wrote to memory of 1600 3652 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 3652 wrote to memory of 1600 3652 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 3652 wrote to memory of 1600 3652 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 3652 wrote to memory of 1600 3652 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 3652 wrote to memory of 1600 3652 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 3652 wrote to memory of 1600 3652 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe PID 3652 wrote to memory of 1600 3652 bsbdejdnlwbrlkj.exe bsbdejdnlwbrlkj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe"C:\Users\Admin\AppData\Local\Temp\e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe"C:\Users\Admin\AppData\Local\Temp\e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exe"C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exe"C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1600
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exeFilesize
441KB
MD5248d93c80c5c4eb6c9294ad7d83c1afc
SHA1f2a934566c9c07afe26cb9d6147dbee3e9e5493e
SHA256e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
SHA5128d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exeFilesize
441KB
MD5248d93c80c5c4eb6c9294ad7d83c1afc
SHA1f2a934566c9c07afe26cb9d6147dbee3e9e5493e
SHA256e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
SHA5128d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
C:\Users\Admin\AppData\Roaming\bsbdejdnlwbrlkj.exeFilesize
441KB
MD5248d93c80c5c4eb6c9294ad7d83c1afc
SHA1f2a934566c9c07afe26cb9d6147dbee3e9e5493e
SHA256e514382ffdd3d60fe257d4243f8960c81bba4935ad0f5d485e39a77fac63eacb
SHA5128d824521db2f8f62cbb78c40db18b17643987acff9df3a7cff3d23824578dc007d9540285bbb2fbf280402c59f5743ec61a6217528a65b77df46631b91b026b0
-
memory/1600-146-0x0000000000000000-mapping.dmp
-
memory/1600-150-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1600-151-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1600-152-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3476-139-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3476-138-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3476-137-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3476-144-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3476-134-0x0000000000000000-mapping.dmp
-
memory/3476-135-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3652-140-0x0000000000000000-mapping.dmp