Analysis
-
max time kernel
169s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 23:05
Behavioral task
behavioral1
Sample
ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe
Resource
win10v2004-20221111-en
General
-
Target
ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe
-
Size
48KB
-
MD5
2c15d4139e50de3470344678f91ba553
-
SHA1
129898fab5a25c1d0963872a038494b97131e3dd
-
SHA256
ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b
-
SHA512
d8fd326663c46bfc8e70622db2b32a276bf2ef8e9748ab7392930c9570c70e6d62c30a05c5cd68fc485d75526131616de6c4e88eabe5f7b3fb9aab55c5fc0371
-
SSDEEP
768:+2hQF74D0kJ4SAR5+U/8Z6GskfnF8nbcuyD7UMTEv:lhQF74A0js5l/4Znunouy8IEv
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2860-140-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2860-141-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2860-142-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3092-155-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
AdobeART.exeAdobeART.exepid process 4488 AdobeART.exe 3092 AdobeART.exe -
Processes:
resource yara_rule behavioral2/memory/1888-132-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2860-136-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2860-139-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1888-138-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2860-140-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2860-141-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2860-142-0x0000000000400000-0x0000000000414000-memory.dmp upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx behavioral2/memory/4488-152-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3092-155-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exeAdobeART.exedescription pid process target process PID 1888 set thread context of 2860 1888 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe PID 4488 set thread context of 3092 4488 AdobeART.exe AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exeAdobeART.exepid process 1888 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe 4488 AdobeART.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exeab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exeAdobeART.exedescription pid process target process PID 1888 wrote to memory of 2860 1888 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe PID 1888 wrote to memory of 2860 1888 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe PID 1888 wrote to memory of 2860 1888 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe PID 1888 wrote to memory of 2860 1888 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe PID 1888 wrote to memory of 2860 1888 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe PID 1888 wrote to memory of 2860 1888 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe PID 1888 wrote to memory of 2860 1888 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe PID 2860 wrote to memory of 4488 2860 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe AdobeART.exe PID 2860 wrote to memory of 4488 2860 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe AdobeART.exe PID 2860 wrote to memory of 4488 2860 ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe AdobeART.exe PID 4488 wrote to memory of 3092 4488 AdobeART.exe AdobeART.exe PID 4488 wrote to memory of 3092 4488 AdobeART.exe AdobeART.exe PID 4488 wrote to memory of 3092 4488 AdobeART.exe AdobeART.exe PID 4488 wrote to memory of 3092 4488 AdobeART.exe AdobeART.exe PID 4488 wrote to memory of 3092 4488 AdobeART.exe AdobeART.exe PID 4488 wrote to memory of 3092 4488 AdobeART.exe AdobeART.exe PID 4488 wrote to memory of 3092 4488 AdobeART.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe"C:\Users\Admin\AppData\Local\Temp\ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe"C:\Users\Admin\AppData\Local\Temp\ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3092
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
48KB
MD52c15d4139e50de3470344678f91ba553
SHA1129898fab5a25c1d0963872a038494b97131e3dd
SHA256ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b
SHA512d8fd326663c46bfc8e70622db2b32a276bf2ef8e9748ab7392930c9570c70e6d62c30a05c5cd68fc485d75526131616de6c4e88eabe5f7b3fb9aab55c5fc0371
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
48KB
MD52c15d4139e50de3470344678f91ba553
SHA1129898fab5a25c1d0963872a038494b97131e3dd
SHA256ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b
SHA512d8fd326663c46bfc8e70622db2b32a276bf2ef8e9748ab7392930c9570c70e6d62c30a05c5cd68fc485d75526131616de6c4e88eabe5f7b3fb9aab55c5fc0371
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
48KB
MD52c15d4139e50de3470344678f91ba553
SHA1129898fab5a25c1d0963872a038494b97131e3dd
SHA256ab6c6241098833f2437aaa2f91d875d480e30dc11b12692f17c9927ee422a15b
SHA512d8fd326663c46bfc8e70622db2b32a276bf2ef8e9748ab7392930c9570c70e6d62c30a05c5cd68fc485d75526131616de6c4e88eabe5f7b3fb9aab55c5fc0371
-
memory/1888-132-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1888-138-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2860-139-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2860-141-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2860-142-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2860-140-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2860-136-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2860-135-0x0000000000000000-mapping.dmp
-
memory/3092-148-0x0000000000000000-mapping.dmp
-
memory/3092-155-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4488-143-0x0000000000000000-mapping.dmp
-
memory/4488-152-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB