Analysis
-
max time kernel
149s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe
Resource
win10v2004-20220812-en
General
-
Target
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe
-
Size
76KB
-
MD5
224eafc304152362f7da0a216c4d4afa
-
SHA1
363a0434337e70d7a65d9f6f244c37c192f1381e
-
SHA256
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6
-
SHA512
32da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea
-
SSDEEP
1536:NQ1uILGBZbj4GUUQT0DrXJ6xOWtGcjt7+7Jriua/wd/x4Hyfh:NQoOG/Xth9DrXJmOWtGcjtS7Juurd/+w
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral1/memory/560-66-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/560-69-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1832-85-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1832-86-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
msiconfiq.exemsiconfiq.exepid process 268 msiconfiq.exe 1832 msiconfiq.exe -
Processes:
resource yara_rule behavioral1/memory/560-57-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/560-59-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/560-60-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/560-64-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/560-65-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/560-66-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/560-69-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1832-85-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1832-86-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Loads dropped DLL 3 IoCs
Processes:
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exefeb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exemsiconfiq.exepid process 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe 560 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe 268 msiconfiq.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiconfiq.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msiconfiq = "C:\\Users\\Admin\\AppData\\Roaming\\msiconfiq.exe" msiconfiq.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exemsiconfiq.exedescription pid process target process PID 1460 set thread context of 560 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 268 set thread context of 1832 268 msiconfiq.exe msiconfiq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 8 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_1 \Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_2 -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exefeb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exemsiconfiq.exedescription pid process target process PID 1460 wrote to memory of 560 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 1460 wrote to memory of 560 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 1460 wrote to memory of 560 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 1460 wrote to memory of 560 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 1460 wrote to memory of 560 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 1460 wrote to memory of 560 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 1460 wrote to memory of 560 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 1460 wrote to memory of 560 1460 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 560 wrote to memory of 268 560 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe msiconfiq.exe PID 560 wrote to memory of 268 560 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe msiconfiq.exe PID 560 wrote to memory of 268 560 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe msiconfiq.exe PID 560 wrote to memory of 268 560 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe msiconfiq.exe PID 268 wrote to memory of 1832 268 msiconfiq.exe msiconfiq.exe PID 268 wrote to memory of 1832 268 msiconfiq.exe msiconfiq.exe PID 268 wrote to memory of 1832 268 msiconfiq.exe msiconfiq.exe PID 268 wrote to memory of 1832 268 msiconfiq.exe msiconfiq.exe PID 268 wrote to memory of 1832 268 msiconfiq.exe msiconfiq.exe PID 268 wrote to memory of 1832 268 msiconfiq.exe msiconfiq.exe PID 268 wrote to memory of 1832 268 msiconfiq.exe msiconfiq.exe PID 268 wrote to memory of 1832 268 msiconfiq.exe msiconfiq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe"C:\Users\Admin\AppData\Local\Temp\feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe"C:\Users\Admin\AppData\Local\Temp\feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exe"C:\Users\Admin\AppData\Roaming\msiconfiq.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exe"C:\Users\Admin\AppData\Roaming\msiconfiq.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\shack.hgFilesize
18KB
MD50a8b78bb9912aac600e0e31591d47004
SHA1c12cc6ebfcb866e0961b5825e18ead16b98eff8d
SHA256290b5bc2590918f596d1963c7b36e88b85a197ec6c797e128d2cf4855e609aad
SHA51277bf7b309c50fc33ec779dd5d4bb7f0de4e0d69041fa7ea9d7588bdea57503481aeb89b717dfb56c6c71d61113a12ec1145464475e924f69cfbab92e3f5baac7
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exeFilesize
76KB
MD5224eafc304152362f7da0a216c4d4afa
SHA1363a0434337e70d7a65d9f6f244c37c192f1381e
SHA256feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6
SHA51232da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exeFilesize
76KB
MD5224eafc304152362f7da0a216c4d4afa
SHA1363a0434337e70d7a65d9f6f244c37c192f1381e
SHA256feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6
SHA51232da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exeFilesize
76KB
MD5224eafc304152362f7da0a216c4d4afa
SHA1363a0434337e70d7a65d9f6f244c37c192f1381e
SHA256feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6
SHA51232da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea
-
\Users\Admin\AppData\Local\Temp\nseFECC.tmp\shack.dllFilesize
48KB
MD5b18a0fac5bcdba749527668527e240c2
SHA1078141c648b8099d5b295fe1cdda28931a4cde45
SHA2565e5e55657c4160d92b8235b00d6404c95c6376e46187e19543d945fab277a8f9
SHA5122d670692c4442cc60f95c6e13de874efccdef00b21a5a90aec57b1cabdf7fe9a943603a9da4c4e002fa673e607e7703e429f1169fa439007bd773a419d51cda6
-
\Users\Admin\AppData\Local\Temp\nsy7014.tmp\shack.dllFilesize
48KB
MD5b18a0fac5bcdba749527668527e240c2
SHA1078141c648b8099d5b295fe1cdda28931a4cde45
SHA2565e5e55657c4160d92b8235b00d6404c95c6376e46187e19543d945fab277a8f9
SHA5122d670692c4442cc60f95c6e13de874efccdef00b21a5a90aec57b1cabdf7fe9a943603a9da4c4e002fa673e607e7703e429f1169fa439007bd773a419d51cda6
-
\Users\Admin\AppData\Roaming\msiconfiq.exeFilesize
76KB
MD5224eafc304152362f7da0a216c4d4afa
SHA1363a0434337e70d7a65d9f6f244c37c192f1381e
SHA256feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6
SHA51232da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea
-
memory/268-68-0x0000000000000000-mapping.dmp
-
memory/560-61-0x0000000000412D10-mapping.dmp
-
memory/560-66-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/560-64-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/560-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/560-69-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/560-65-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/560-59-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/560-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/560-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1460-54-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/1832-80-0x0000000000412D10-mapping.dmp
-
memory/1832-85-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1832-86-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB