Analysis
-
max time kernel
186s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 02:24
Static task
static1
Behavioral task
behavioral1
Sample
627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe
Resource
win10v2004-20220812-en
General
-
Target
627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe
-
Size
121KB
-
MD5
22f898d4a880f2e284bef5f183a05aa2
-
SHA1
e65b0ba02e551a43f7f1377c6cb12695e6170752
-
SHA256
627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22
-
SHA512
c6f12c7c15cc7d11729a643012436463be43af30dbcf2de7cbe201d01e53e84831422909c82e77cdd384d609685401e427c6d55bddaa582f4c453bcad8299e48
-
SSDEEP
3072:yJJ2ql3+A5+JBJA0U4zZaEY2cVq9ftIwRoGnc1MdfX:yJJ2qJvw6TEY2cVkNyj4X
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SHELL = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\KB3215693\\KB3215693.exe\"" svchost.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions svchost.exe -
ModiLoader Second Stage 7 IoCs
Processes:
resource yara_rule behavioral1/memory/936-58-0x0000000000400000-0x0000000000415000-memory.dmp modiloader_stage2 behavioral1/memory/936-59-0x0000000000400000-0x0000000000415000-memory.dmp modiloader_stage2 behavioral1/memory/936-60-0x0000000000400000-0x0000000000415000-memory.dmp modiloader_stage2 behavioral1/memory/936-63-0x00000000004044F0-mapping.dmp modiloader_stage2 behavioral1/memory/936-62-0x0000000000400000-0x0000000000415000-memory.dmp modiloader_stage2 behavioral1/memory/936-67-0x0000000000400000-0x0000000000415000-memory.dmp modiloader_stage2 behavioral1/memory/936-68-0x0000000000400000-0x0000000000415000-memory.dmp modiloader_stage2 -
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KB3215693 = "\"C:\\Users\\Admin\\AppData\\Local\\KB3215693\\KB3215693.exe\"" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KB3215693 = "\"C:\\Users\\Admin\\AppData\\Local\\KB3215693\\KB3215693.exe\"" svchost.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" svchost.exe -
Disables Task Manager via registry modification
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools svchost.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 752 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KB3215693 = "\"C:\\Users\\Admin\\AppData\\Local\\KB3215693\\KB3215693.exe\"" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\KB3215693 = "\"C:\\Users\\Admin\\AppData\\Local\\KB3215693\\KB3215693.exe\"" svchost.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exedescription pid process target process PID 1520 set thread context of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe -
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Enable AutoImageResize = "yes" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Play_Animations = "yes" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\UseThemes = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes" svchost.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exesvchost.exepid process 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe 752 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exepid process 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exepid process 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
svchost.exepid process 752 svchost.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exedescription pid process target process PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 1520 wrote to memory of 936 1520 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe PID 936 wrote to memory of 752 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe svchost.exe PID 936 wrote to memory of 752 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe svchost.exe PID 936 wrote to memory of 752 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe svchost.exe PID 936 wrote to memory of 752 936 627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe"C:\Users\Admin\AppData\Local\Temp\627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exeC:\Users\Admin\AppData\Local\Temp\627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"svchost.exe" c:\users\admin\appdata\local\temp\627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exepath<<c:\users\admin\appdata\local\temp\627709624a61471f42b8856d7d2b35e116efa6cc00c3415b72ca7dbc8de64f22.exe>>path3⤵
- Modifies WinLogon for persistence
- Looks for VirtualBox Guest Additions in registry
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/752-69-0x0000000000000000-mapping.dmp
-
memory/752-71-0x00000000002C0000-0x00000000002C8000-memory.dmpFilesize
32KB
-
memory/936-63-0x00000000004044F0-mapping.dmp
-
memory/936-56-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/936-59-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/936-60-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/936-62-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/936-67-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/936-68-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/936-58-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/936-55-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1520-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1520-64-0x0000000000270000-0x0000000000274000-memory.dmpFilesize
16KB