Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 19:47
Static task
static1
Behavioral task
behavioral1
Sample
era 1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
era 1.exe
Resource
win10v2004-20220812-en
General
-
Target
era 1.exe
-
Size
862KB
-
MD5
84bf18cdc14d7e2c5311ff6cd071a0dc
-
SHA1
a784ef5651e7e1530d4e77ab9f7f3507b51d9e67
-
SHA256
f53107b892a50e33ff130e01cf391a2b69524dbe09b75cc13192365bbd6eda11
-
SHA512
97434045c4c0c4d82296c668ec01a8ae31a9eee9bfba7db6f2d314f1574d3ee950b6a7566a0faa313a1e396541dff76be4cedac8d96bd342ed8783d1f7dc4c0d
-
SSDEEP
12288:fSj5lclcaywFMtTPWQOQSJU3FtJlpCBIUQZC8fRuHT6Kk/RqIkr:fSVKFp6rfn/VXPCyE8fMuqI
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4152-132-0x0000000003E90000-0x0000000003EBB000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule behavioral2/memory/4152-135-0x0000000030410000-0x00000000307F4000-memory.dmp upx behavioral2/memory/4152-136-0x0000000030410000-0x00000000307F4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
era 1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kqrihjva = "C:\\Users\\Public\\Libraries\\avjhirqK.url" era 1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
era 1.exepid process 4152 era 1.exe 4152 era 1.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
era 1.exedescription pid process target process PID 4152 wrote to memory of 1488 4152 era 1.exe wscript.exe PID 4152 wrote to memory of 1488 4152 era 1.exe wscript.exe PID 4152 wrote to memory of 1488 4152 era 1.exe wscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\era 1.exe"C:\Users\Admin\AppData\Local\Temp\era 1.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-134-0x0000000000000000-mapping.dmp
-
memory/4152-132-0x0000000003E90000-0x0000000003EBB000-memory.dmpFilesize
172KB
-
memory/4152-135-0x0000000030410000-0x00000000307F4000-memory.dmpFilesize
3.9MB
-
memory/4152-136-0x0000000030410000-0x00000000307F4000-memory.dmpFilesize
3.9MB