Analysis
-
max time kernel
269s -
max time network
339s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 16:18
Static task
static1
Behavioral task
behavioral1
Sample
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe
Resource
win10v2004-20220901-en
General
-
Target
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe
-
Size
62KB
-
MD5
122a5ca7aee59f9c5ddeada803c56e4f
-
SHA1
d276687c119a98568638a6bb88feb9c6d4e78c4d
-
SHA256
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
-
SHA512
08e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
SSDEEP
1536:1o+yOVkQit5+oxRQvT65RxY91b3tGwbkg44iT8X:1o+ymkQit5evQvY3dGwbkghiQX
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-72-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1632-76-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1924-90-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1924-91-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
AdobeART.exeAdobeART.exepid process 560 AdobeART.exe 1924 AdobeART.exe -
Processes:
resource yara_rule behavioral1/memory/1172-57-0x0000000000080000-0x0000000000094000-memory.dmp upx behavioral1/memory/1172-59-0x0000000000080000-0x0000000000094000-memory.dmp upx behavioral1/memory/1632-66-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1632-71-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1632-72-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1632-76-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1924-89-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1924-90-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1924-91-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exepid process 1632 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exeAdobeART.exedescription pid process target process PID 468 set thread context of 1172 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 set thread context of 1632 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 560 set thread context of 1924 560 AdobeART.exe AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exeAdobeART.exepid process 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 560 AdobeART.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exeAdobeART.exedescription pid process Token: SeDebugPrivilege 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe Token: SeDebugPrivilege 560 AdobeART.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exeAdobeART.exedescription pid process target process PID 468 wrote to memory of 1172 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1172 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1172 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1172 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1172 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1172 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1172 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1172 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1632 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1632 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1632 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1632 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1632 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1632 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1632 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 468 wrote to memory of 1632 468 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 1632 wrote to memory of 560 1632 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe AdobeART.exe PID 1632 wrote to memory of 560 1632 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe AdobeART.exe PID 1632 wrote to memory of 560 1632 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe AdobeART.exe PID 1632 wrote to memory of 560 1632 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe AdobeART.exe PID 560 wrote to memory of 1924 560 AdobeART.exe AdobeART.exe PID 560 wrote to memory of 1924 560 AdobeART.exe AdobeART.exe PID 560 wrote to memory of 1924 560 AdobeART.exe AdobeART.exe PID 560 wrote to memory of 1924 560 AdobeART.exe AdobeART.exe PID 560 wrote to memory of 1924 560 AdobeART.exe AdobeART.exe PID 560 wrote to memory of 1924 560 AdobeART.exe AdobeART.exe PID 560 wrote to memory of 1924 560 AdobeART.exe AdobeART.exe PID 560 wrote to memory of 1924 560 AdobeART.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"2⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1924
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
62KB
MD5122a5ca7aee59f9c5ddeada803c56e4f
SHA1d276687c119a98568638a6bb88feb9c6d4e78c4d
SHA2566cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
SHA51208e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
62KB
MD5122a5ca7aee59f9c5ddeada803c56e4f
SHA1d276687c119a98568638a6bb88feb9c6d4e78c4d
SHA2566cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
SHA51208e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
62KB
MD5122a5ca7aee59f9c5ddeada803c56e4f
SHA1d276687c119a98568638a6bb88feb9c6d4e78c4d
SHA2566cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
SHA51208e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
62KB
MD5122a5ca7aee59f9c5ddeada803c56e4f
SHA1d276687c119a98568638a6bb88feb9c6d4e78c4d
SHA2566cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
SHA51208e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
memory/468-55-0x0000000074290000-0x000000007483B000-memory.dmpFilesize
5.7MB
-
memory/468-54-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB
-
memory/468-69-0x0000000074290000-0x000000007483B000-memory.dmpFilesize
5.7MB
-
memory/560-87-0x00000000740F0000-0x000000007469B000-memory.dmpFilesize
5.7MB
-
memory/560-74-0x0000000000000000-mapping.dmp
-
memory/1172-61-0x0000000000412D20-mapping.dmp
-
memory/1172-59-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1172-57-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1172-56-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1632-72-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1632-71-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1632-66-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1632-67-0x0000000000412D20-mapping.dmp
-
memory/1632-76-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1924-84-0x0000000000412D20-mapping.dmp
-
memory/1924-89-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1924-90-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1924-91-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB