Analysis
-
max time kernel
165s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe
Resource
win10v2004-20220812-en
General
-
Target
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe
-
Size
76KB
-
MD5
224eafc304152362f7da0a216c4d4afa
-
SHA1
363a0434337e70d7a65d9f6f244c37c192f1381e
-
SHA256
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6
-
SHA512
32da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea
-
SSDEEP
1536:NQ1uILGBZbj4GUUQT0DrXJ6xOWtGcjt7+7Jriua/wd/x4Hyfh:NQoOG/Xth9DrXJmOWtGcjtS7Juurd/+w
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4868-137-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4868-141-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4496-149-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4496-150-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
msiconfiq.exemsiconfiq.exepid process 4808 msiconfiq.exe 4496 msiconfiq.exe -
Processes:
resource yara_rule behavioral2/memory/4868-134-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4868-136-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4868-137-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4868-141-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4496-148-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4496-149-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4496-150-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe -
Loads dropped DLL 2 IoCs
Processes:
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exemsiconfiq.exepid process 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe 4808 msiconfiq.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiconfiq.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msiconfiq = "C:\\Users\\Admin\\AppData\\Roaming\\msiconfiq.exe" msiconfiq.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exemsiconfiq.exedescription pid process target process PID 3132 set thread context of 4868 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 4808 set thread context of 4496 4808 msiconfiq.exe msiconfiq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\msiconfiq.exe nsis_installer_2 -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exefeb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exemsiconfiq.exedescription pid process target process PID 3132 wrote to memory of 4868 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 3132 wrote to memory of 4868 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 3132 wrote to memory of 4868 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 3132 wrote to memory of 4868 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 3132 wrote to memory of 4868 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 3132 wrote to memory of 4868 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 3132 wrote to memory of 4868 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 3132 wrote to memory of 4868 3132 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe PID 4868 wrote to memory of 4808 4868 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe msiconfiq.exe PID 4868 wrote to memory of 4808 4868 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe msiconfiq.exe PID 4868 wrote to memory of 4808 4868 feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe msiconfiq.exe PID 4808 wrote to memory of 4496 4808 msiconfiq.exe msiconfiq.exe PID 4808 wrote to memory of 4496 4808 msiconfiq.exe msiconfiq.exe PID 4808 wrote to memory of 4496 4808 msiconfiq.exe msiconfiq.exe PID 4808 wrote to memory of 4496 4808 msiconfiq.exe msiconfiq.exe PID 4808 wrote to memory of 4496 4808 msiconfiq.exe msiconfiq.exe PID 4808 wrote to memory of 4496 4808 msiconfiq.exe msiconfiq.exe PID 4808 wrote to memory of 4496 4808 msiconfiq.exe msiconfiq.exe PID 4808 wrote to memory of 4496 4808 msiconfiq.exe msiconfiq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe"C:\Users\Admin\AppData\Local\Temp\feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe"C:\Users\Admin\AppData\Local\Temp\feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exe"C:\Users\Admin\AppData\Roaming\msiconfiq.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exe"C:\Users\Admin\AppData\Roaming\msiconfiq.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsgCBD2.tmp\shack.dllFilesize
48KB
MD5b18a0fac5bcdba749527668527e240c2
SHA1078141c648b8099d5b295fe1cdda28931a4cde45
SHA2565e5e55657c4160d92b8235b00d6404c95c6376e46187e19543d945fab277a8f9
SHA5122d670692c4442cc60f95c6e13de874efccdef00b21a5a90aec57b1cabdf7fe9a943603a9da4c4e002fa673e607e7703e429f1169fa439007bd773a419d51cda6
-
C:\Users\Admin\AppData\Local\Temp\nsmDA78.tmp\shack.dllFilesize
48KB
MD5b18a0fac5bcdba749527668527e240c2
SHA1078141c648b8099d5b295fe1cdda28931a4cde45
SHA2565e5e55657c4160d92b8235b00d6404c95c6376e46187e19543d945fab277a8f9
SHA5122d670692c4442cc60f95c6e13de874efccdef00b21a5a90aec57b1cabdf7fe9a943603a9da4c4e002fa673e607e7703e429f1169fa439007bd773a419d51cda6
-
C:\Users\Admin\AppData\Local\Temp\shack.hgFilesize
18KB
MD50a8b78bb9912aac600e0e31591d47004
SHA1c12cc6ebfcb866e0961b5825e18ead16b98eff8d
SHA256290b5bc2590918f596d1963c7b36e88b85a197ec6c797e128d2cf4855e609aad
SHA51277bf7b309c50fc33ec779dd5d4bb7f0de4e0d69041fa7ea9d7588bdea57503481aeb89b717dfb56c6c71d61113a12ec1145464475e924f69cfbab92e3f5baac7
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exeFilesize
76KB
MD5224eafc304152362f7da0a216c4d4afa
SHA1363a0434337e70d7a65d9f6f244c37c192f1381e
SHA256feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6
SHA51232da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exeFilesize
76KB
MD5224eafc304152362f7da0a216c4d4afa
SHA1363a0434337e70d7a65d9f6f244c37c192f1381e
SHA256feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6
SHA51232da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea
-
C:\Users\Admin\AppData\Roaming\msiconfiq.exeFilesize
76KB
MD5224eafc304152362f7da0a216c4d4afa
SHA1363a0434337e70d7a65d9f6f244c37c192f1381e
SHA256feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6
SHA51232da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea
-
memory/4496-144-0x0000000000000000-mapping.dmp
-
memory/4496-150-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4496-149-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4496-148-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4808-138-0x0000000000000000-mapping.dmp
-
memory/4868-137-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4868-141-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4868-136-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4868-134-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4868-133-0x0000000000000000-mapping.dmp