Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 16:18
Static task
static1
Behavioral task
behavioral1
Sample
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe
Resource
win10v2004-20220901-en
General
-
Target
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe
-
Size
62KB
-
MD5
122a5ca7aee59f9c5ddeada803c56e4f
-
SHA1
d276687c119a98568638a6bb88feb9c6d4e78c4d
-
SHA256
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
-
SHA512
08e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
SSDEEP
1536:1o+yOVkQit5+oxRQvT65RxY91b3tGwbkg44iT8X:1o+ymkQit5evQvY3dGwbkghiQX
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/408-137-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/408-139-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3908-148-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3908-150-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3908-151-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
AdobeART.exeAdobeART.exepid process 2280 AdobeART.exe 3908 AdobeART.exe -
Processes:
resource yara_rule behavioral2/memory/408-134-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/408-136-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/408-137-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/408-139-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3908-147-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3908-148-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3908-150-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3908-151-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exeAdobeART.exedescription pid process target process PID 2084 set thread context of 408 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 2280 set thread context of 3908 2280 AdobeART.exe AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exeAdobeART.exepid process 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 2280 AdobeART.exe 2280 AdobeART.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exeAdobeART.exedescription pid process Token: SeDebugPrivilege 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe Token: SeDebugPrivilege 2280 AdobeART.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exeAdobeART.exedescription pid process target process PID 2084 wrote to memory of 408 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 2084 wrote to memory of 408 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 2084 wrote to memory of 408 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 2084 wrote to memory of 408 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 2084 wrote to memory of 408 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 2084 wrote to memory of 408 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 2084 wrote to memory of 408 2084 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe PID 408 wrote to memory of 2280 408 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe AdobeART.exe PID 408 wrote to memory of 2280 408 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe AdobeART.exe PID 408 wrote to memory of 2280 408 6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe AdobeART.exe PID 2280 wrote to memory of 3908 2280 AdobeART.exe AdobeART.exe PID 2280 wrote to memory of 3908 2280 AdobeART.exe AdobeART.exe PID 2280 wrote to memory of 3908 2280 AdobeART.exe AdobeART.exe PID 2280 wrote to memory of 3908 2280 AdobeART.exe AdobeART.exe PID 2280 wrote to memory of 3908 2280 AdobeART.exe AdobeART.exe PID 2280 wrote to memory of 3908 2280 AdobeART.exe AdobeART.exe PID 2280 wrote to memory of 3908 2280 AdobeART.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"C:\Users\Admin\AppData\Local\Temp\6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
62KB
MD5122a5ca7aee59f9c5ddeada803c56e4f
SHA1d276687c119a98568638a6bb88feb9c6d4e78c4d
SHA2566cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
SHA51208e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
62KB
MD5122a5ca7aee59f9c5ddeada803c56e4f
SHA1d276687c119a98568638a6bb88feb9c6d4e78c4d
SHA2566cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
SHA51208e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
62KB
MD5122a5ca7aee59f9c5ddeada803c56e4f
SHA1d276687c119a98568638a6bb88feb9c6d4e78c4d
SHA2566cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
SHA51208e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
memory/408-137-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/408-133-0x0000000000000000-mapping.dmp
-
memory/408-139-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/408-136-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/408-134-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2084-138-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2084-132-0x0000000074FD0000-0x0000000075581000-memory.dmpFilesize
5.7MB
-
memory/2280-149-0x00000000741A0000-0x0000000074751000-memory.dmpFilesize
5.7MB
-
memory/2280-140-0x0000000000000000-mapping.dmp
-
memory/3908-143-0x0000000000000000-mapping.dmp
-
memory/3908-147-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3908-148-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3908-150-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3908-151-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB