Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 17:19
Behavioral task
behavioral1
Sample
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe
Resource
win10v2004-20220812-en
General
-
Target
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe
-
Size
443KB
-
MD5
3e9b02fef05c3364a4d688f3b7ea8741
-
SHA1
ecb95240df4befdbdc96e3697b13a32a43296095
-
SHA256
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
-
SHA512
1fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
SSDEEP
12288:XFJs3XraGmcmd/26o9juQ+pDQZPCgev4YYbTu:Xjs3XFxxpJ+pDKQJoTu
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3796-145-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3796-146-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4240-161-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4240-162-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4240-163-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 7 IoCs
Processes:
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.execec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.execec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeAdobeART.exeAdobeART.exeAdobeART.exeAdobeART.exepid process 2492 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe 4332 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe 3796 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe 3532 AdobeART.exe 2068 AdobeART.exe 4040 AdobeART.exe 4240 AdobeART.exe -
Processes:
resource yara_rule behavioral2/memory/1200-132-0x0000000000400000-0x00000000004E5000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe upx C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe upx behavioral2/memory/3796-140-0x0000000000400000-0x0000000000414000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe upx behavioral2/memory/1200-143-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/3796-144-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3796-145-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3796-146-0x0000000000400000-0x0000000000414000-memory.dmp upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startupx\system.pif upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx behavioral2/memory/3532-159-0x0000000000400000-0x00000000004E5000-memory.dmp upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx behavioral2/memory/4240-160-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4240-161-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4240-162-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4240-163-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1200-143-0x0000000000400000-0x00000000004E5000-memory.dmp autoit_exe behavioral2/memory/3532-159-0x0000000000400000-0x00000000004E5000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeAdobeART.exedescription pid process target process PID 1200 set thread context of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 3532 set thread context of 4240 3532 AdobeART.exe AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeAdobeART.exepid process 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe 3532 AdobeART.exe 3532 AdobeART.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.execec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeAdobeART.exedescription pid process target process PID 1200 wrote to memory of 2492 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 2492 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 2492 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 4332 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 4332 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 4332 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 1200 wrote to memory of 3796 1200 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe PID 3796 wrote to memory of 3532 3796 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe AdobeART.exe PID 3796 wrote to memory of 3532 3796 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe AdobeART.exe PID 3796 wrote to memory of 3532 3796 cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe AdobeART.exe PID 3532 wrote to memory of 2068 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 2068 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 2068 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4040 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4040 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4040 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4240 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4240 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4240 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4240 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4240 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4240 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4240 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4240 3532 AdobeART.exe AdobeART.exe PID 3532 wrote to memory of 4240 3532 AdobeART.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe"C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeC:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe2⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeC:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe2⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeC:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Roaming\AdobeART.exeC:\Users\Admin\AppData\Roaming\AdobeART.exe4⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Roaming\AdobeART.exeC:\Users\Admin\AppData\Roaming\AdobeART.exe4⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Roaming\AdobeART.exeC:\Users\Admin\AppData\Roaming\AdobeART.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4240
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeFilesize
443KB
MD53e9b02fef05c3364a4d688f3b7ea8741
SHA1ecb95240df4befdbdc96e3697b13a32a43296095
SHA256cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
SHA5121fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeFilesize
443KB
MD53e9b02fef05c3364a4d688f3b7ea8741
SHA1ecb95240df4befdbdc96e3697b13a32a43296095
SHA256cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
SHA5121fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
C:\Users\Admin\AppData\Local\Temp\cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d.exeFilesize
443KB
MD53e9b02fef05c3364a4d688f3b7ea8741
SHA1ecb95240df4befdbdc96e3697b13a32a43296095
SHA256cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
SHA5121fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
443KB
MD53e9b02fef05c3364a4d688f3b7ea8741
SHA1ecb95240df4befdbdc96e3697b13a32a43296095
SHA256cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
SHA5121fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
443KB
MD53e9b02fef05c3364a4d688f3b7ea8741
SHA1ecb95240df4befdbdc96e3697b13a32a43296095
SHA256cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
SHA5121fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
443KB
MD53e9b02fef05c3364a4d688f3b7ea8741
SHA1ecb95240df4befdbdc96e3697b13a32a43296095
SHA256cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
SHA5121fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
443KB
MD53e9b02fef05c3364a4d688f3b7ea8741
SHA1ecb95240df4befdbdc96e3697b13a32a43296095
SHA256cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
SHA5121fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
443KB
MD53e9b02fef05c3364a4d688f3b7ea8741
SHA1ecb95240df4befdbdc96e3697b13a32a43296095
SHA256cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
SHA5121fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startupx\system.pifFilesize
443KB
MD53e9b02fef05c3364a4d688f3b7ea8741
SHA1ecb95240df4befdbdc96e3697b13a32a43296095
SHA256cec38dab7cb263d1cd96f3908a87d7282df4dcdf3e362b773414e4a2d766862d
SHA5121fa50f692e8be489ae923ec0e5fec8aca41e7eaba32d4471e795051be2ffb8040c569b246ff351c3e49a6056eea027113baf1c94bff890aebcd83062606fbe29
-
memory/1200-134-0x0000000000B90000-0x0000000000B94000-memory.dmpFilesize
16KB
-
memory/1200-143-0x0000000000400000-0x00000000004E5000-memory.dmpFilesize
916KB
-
memory/1200-133-0x0000000004360000-0x00000000044C0000-memory.dmpFilesize
1.4MB
-
memory/1200-132-0x0000000000400000-0x00000000004E5000-memory.dmpFilesize
916KB
-
memory/2068-151-0x0000000000000000-mapping.dmp
-
memory/2492-135-0x0000000000000000-mapping.dmp
-
memory/3532-147-0x0000000000000000-mapping.dmp
-
memory/3532-159-0x0000000000400000-0x00000000004E5000-memory.dmpFilesize
916KB
-
memory/3796-139-0x0000000000000000-mapping.dmp
-
memory/3796-144-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3796-140-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3796-146-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3796-145-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4040-153-0x0000000000000000-mapping.dmp
-
memory/4240-155-0x0000000000000000-mapping.dmp
-
memory/4240-160-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4240-161-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4240-162-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4240-163-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4332-137-0x0000000000000000-mapping.dmp