Overview

overview

10

Static

static

10

b7381eb584...94.exe

windows7-x64

10

b7381eb584...94.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    202s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2022 00:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b7381eb5843fe3628b1f24e624d8f41bcc2689799843a344f338e45902ccee94.exe

  • Size

    438KB

  • MD5

    b9c9d8a0f99d7a0df02ea45e5756a637

  • SHA1

    7c31f243c91fd6b041aa1b21601492ad8f058aae

  • SHA256

    b7381eb5843fe3628b1f24e624d8f41bcc2689799843a344f338e45902ccee94

  • SHA512

    d15e2be208eb2643d728758a33ab3add1a5fc0efaa2da364759aa129007aa6ef482bc3d5ff590c6c1cbf5c83e6e62928033f2160a93f1bb7afe0f194b5e88900

  • SSDEEP

    6144:k93nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXo7ILy84uc:Enx2GjMY3XKfd/H/9Pm8+uc

Score
10/10
modiloaderneshtapersistencespywaretrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 27 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7381eb5843fe3628b1f24e624d8f41bcc2689799843a344f338e45902ccee94.exe
    "C:\Users\Admin\AppData\Local\Temp\b7381eb5843fe3628b1f24e624d8f41bcc2689799843a344f338e45902ccee94.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Users\Admin\AppData\Local\Temp\3582-490\b7381eb5843fe3628b1f24e624d8f41bcc2689799843a344f338e45902ccee94.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\b7381eb5843fe3628b1f24e624d8f41bcc2689799843a344f338e45902ccee94.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:1068
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3582-490\b7381eb5843fe3628b1f24e624d8f41bcc2689799843a344f338e45902ccee94.exe
    Filesize

    397KB

    MD5

    381919c65ffd0b9b51f20b55cce5a936

    SHA1

    0bc86e95b92ed9c0b6485fa08bb9d1074ff3cf0d

    SHA256

    1c28327767c1c02147eabe460282aac0e9e85c457cb89ff7fdd3c3e202284a23

    SHA512

    017b7f5d453b722217642363eaa5b566f69e7b8b29199053eb5517900cc8aa04d962ea9ceb4eb02563a229562f45926c57165c8bca73b408588afe1200673e1d

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3582-490\b7381eb5843fe3628b1f24e624d8f41bcc2689799843a344f338e45902ccee94.exe
    Filesize

    397KB

    MD5

    381919c65ffd0b9b51f20b55cce5a936

    SHA1

    0bc86e95b92ed9c0b6485fa08bb9d1074ff3cf0d

    SHA256

    1c28327767c1c02147eabe460282aac0e9e85c457cb89ff7fdd3c3e202284a23

    SHA512

    017b7f5d453b722217642363eaa5b566f69e7b8b29199053eb5517900cc8aa04d962ea9ceb4eb02563a229562f45926c57165c8bca73b408588afe1200673e1d

    Download Submit
  • memory/1068-132-0x0000000000000000-mapping.dmp
    Download