Analysis
-
max time kernel
150s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 15:13
Static task
static1
Behavioral task
behavioral1
Sample
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe
Resource
win10v2004-20221111-en
General
-
Target
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe
-
Size
67KB
-
MD5
0f9431680d0faef375d72c7891ad4cce
-
SHA1
a22e289b3280369fbcda6bbd69be817a68face75
-
SHA256
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
-
SHA512
b859f0d022d1bb2fe2d242ddb8b31c65a02a918247ff15fc85508d9db63c7a04c8a50f64433ab635fdef90ada0ebf0b1a72d9fa0c0e9557a145f2dde5a9dd18d
-
SSDEEP
1536:xvu67jVd881H9+LsD8T5Ilppe2/ezI2PesVXZNh:xvu67jb881d+gD8T2lppeFI2Pe01
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1640-66-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1640-67-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1052-87-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1052-88-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1052-89-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
AdobeART.exeAdobeART.exepid process 664 AdobeART.exe 1052 AdobeART.exe -
Processes:
resource yara_rule behavioral1/memory/1640-58-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1640-60-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1640-61-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1640-65-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1640-66-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1640-67-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1052-85-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1052-87-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1052-88-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1052-89-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exepid process 1640 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 1640 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exeAdobeART.exedescription pid process target process PID 1316 set thread context of 1640 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe PID 664 set thread context of 1052 664 AdobeART.exe AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exeAdobeART.exepid process 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 664 AdobeART.exe 664 AdobeART.exe 664 AdobeART.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exeAdobeART.exedescription pid process Token: SeDebugPrivilege 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe Token: SeDebugPrivilege 664 AdobeART.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exeAdobeART.exedescription pid process target process PID 1316 wrote to memory of 1640 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe PID 1316 wrote to memory of 1640 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe PID 1316 wrote to memory of 1640 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe PID 1316 wrote to memory of 1640 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe PID 1316 wrote to memory of 1640 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe PID 1316 wrote to memory of 1640 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe PID 1316 wrote to memory of 1640 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe PID 1316 wrote to memory of 1640 1316 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe PID 1640 wrote to memory of 664 1640 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe AdobeART.exe PID 1640 wrote to memory of 664 1640 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe AdobeART.exe PID 1640 wrote to memory of 664 1640 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe AdobeART.exe PID 1640 wrote to memory of 664 1640 2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe AdobeART.exe PID 664 wrote to memory of 1052 664 AdobeART.exe AdobeART.exe PID 664 wrote to memory of 1052 664 AdobeART.exe AdobeART.exe PID 664 wrote to memory of 1052 664 AdobeART.exe AdobeART.exe PID 664 wrote to memory of 1052 664 AdobeART.exe AdobeART.exe PID 664 wrote to memory of 1052 664 AdobeART.exe AdobeART.exe PID 664 wrote to memory of 1052 664 AdobeART.exe AdobeART.exe PID 664 wrote to memory of 1052 664 AdobeART.exe AdobeART.exe PID 664 wrote to memory of 1052 664 AdobeART.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe"C:\Users\Admin\AppData\Local\Temp\2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe"C:\Users\Admin\AppData\Local\Temp\2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1052
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
67KB
MD50f9431680d0faef375d72c7891ad4cce
SHA1a22e289b3280369fbcda6bbd69be817a68face75
SHA2562b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
SHA512b859f0d022d1bb2fe2d242ddb8b31c65a02a918247ff15fc85508d9db63c7a04c8a50f64433ab635fdef90ada0ebf0b1a72d9fa0c0e9557a145f2dde5a9dd18d
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
67KB
MD50f9431680d0faef375d72c7891ad4cce
SHA1a22e289b3280369fbcda6bbd69be817a68face75
SHA2562b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
SHA512b859f0d022d1bb2fe2d242ddb8b31c65a02a918247ff15fc85508d9db63c7a04c8a50f64433ab635fdef90ada0ebf0b1a72d9fa0c0e9557a145f2dde5a9dd18d
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
67KB
MD50f9431680d0faef375d72c7891ad4cce
SHA1a22e289b3280369fbcda6bbd69be817a68face75
SHA2562b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
SHA512b859f0d022d1bb2fe2d242ddb8b31c65a02a918247ff15fc85508d9db63c7a04c8a50f64433ab635fdef90ada0ebf0b1a72d9fa0c0e9557a145f2dde5a9dd18d
-
\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
67KB
MD50f9431680d0faef375d72c7891ad4cce
SHA1a22e289b3280369fbcda6bbd69be817a68face75
SHA2562b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
SHA512b859f0d022d1bb2fe2d242ddb8b31c65a02a918247ff15fc85508d9db63c7a04c8a50f64433ab635fdef90ada0ebf0b1a72d9fa0c0e9557a145f2dde5a9dd18d
-
\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
67KB
MD50f9431680d0faef375d72c7891ad4cce
SHA1a22e289b3280369fbcda6bbd69be817a68face75
SHA2562b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
SHA512b859f0d022d1bb2fe2d242ddb8b31c65a02a918247ff15fc85508d9db63c7a04c8a50f64433ab635fdef90ada0ebf0b1a72d9fa0c0e9557a145f2dde5a9dd18d
-
memory/664-86-0x0000000074820000-0x0000000074DCB000-memory.dmpFilesize
5.7MB
-
memory/664-75-0x0000000074820000-0x0000000074DCB000-memory.dmpFilesize
5.7MB
-
memory/664-71-0x0000000000000000-mapping.dmp
-
memory/1052-81-0x0000000000412D20-mapping.dmp
-
memory/1052-89-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1052-88-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1052-87-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1052-85-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1316-54-0x0000000075351000-0x0000000075353000-memory.dmpFilesize
8KB
-
memory/1316-68-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1316-55-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1316-56-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1640-62-0x0000000000412D20-mapping.dmp
-
memory/1640-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-58-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-61-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-66-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-65-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-67-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB