Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2022 09:59

General

  • Target

    619f2b032e823dcac8b556613ffe99bb275206b1ed198518f3ee1295a1e9cdea.exe

  • Size

    764KB

  • MD5

    2040fc52d862c02998319f36af346126

  • SHA1

    6d03f8659f0067cc89fdb88ab46a1ff2d17e7f7f

  • SHA256

    619f2b032e823dcac8b556613ffe99bb275206b1ed198518f3ee1295a1e9cdea

  • SHA512

    8707425cd3143fc9d25e16206db5b30934a8c277ba938c7a61e31a47d863586649bf0002eb5cebcb0475ab41e97b5b654f7ae116ce13e5a21167548002e42c8e

  • SSDEEP

    12288:6c//////uD6Hkdj5tu4039Z/kZbV8PQDkthEIX6PlLad+Dj/IX5Hl13pPOh7Lje1:6c//////C6EdvM9ZsZb8QDtIXcLW6/IB

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\619f2b032e823dcac8b556613ffe99bb275206b1ed198518f3ee1295a1e9cdea.exe
    "C:\Users\Admin\AppData\Local\Temp\619f2b032e823dcac8b556613ffe99bb275206b1ed198518f3ee1295a1e9cdea.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Users\Admin\AppData\Local\Temp\619f2b032e823dcac8b556613ffe99bb275206b1ed198518f3ee1295a1e9cdea.exe
      C:\Users\Admin\AppData\Local\Temp\619f2b032e823dcac8b556613ffe99bb275206b1ed198518f3ee1295a1e9cdea.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\program files\internet explorer\IEXPLORE.EXE
        "C:\program files\internet explorer\IEXPLORE.EXE"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4176
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4176 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4760-132-0x0000000000000000-mapping.dmp
  • memory/4760-133-0x0000000000400000-0x00000000004C6000-memory.dmp
    Filesize

    792KB

  • memory/4760-134-0x0000000000400000-0x00000000004C6000-memory.dmp
    Filesize

    792KB

  • memory/4760-135-0x0000000000400000-0x00000000004C6000-memory.dmp
    Filesize

    792KB

  • memory/4760-136-0x0000000000400000-0x00000000004C6000-memory.dmp
    Filesize

    792KB

  • memory/4760-137-0x0000000000400000-0x00000000004C6000-memory.dmp
    Filesize

    792KB