Analysis
-
max time kernel
79s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 22:18
Static task
static1
Behavioral task
behavioral1
Sample
b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exe
Resource
win10v2004-20220812-en
General
-
Target
b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exe
-
Size
155KB
-
MD5
d3bb560701d2b6ca0440c22c6679567e
-
SHA1
d15f10faff11d1fbdc3bc2c6e114608ad1a177fd
-
SHA256
b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e
-
SHA512
b24da9cf07a263723f6ed7b3efab8129211de89b78e5b715add601f8dbffe57aebf45c54cd7c76a3b1127ee55334f082ba4652b4f86a0a40e7d13faf7f216bcd
-
SSDEEP
3072:FI3vzbT934wKn7Pbk+DFTz9rW8dUJXEtbiYHPy6Wq46kZg+uc3NCcoKB5jWoIEif:FsLbh34wK7o+DpJi8UObDtDHc3NCcnLE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3732-136-0x0000000000400000-0x000000000045F208-memory.dmp modiloader_stage2 behavioral2/memory/4232-137-0x0000000000400000-0x000000000045F208-memory.dmp modiloader_stage2 behavioral2/memory/3732-142-0x0000000000400000-0x000000000045F208-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
netservice.exepid process 3732 netservice.exe -
Processes:
resource yara_rule behavioral2/memory/3732-139-0x0000000010410000-0x0000000010465000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
netservice.exedescription pid process Token: SeDebugPrivilege 3732 netservice.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exenetservice.exedescription pid process target process PID 4232 wrote to memory of 3940 4232 b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exe cmd.exe PID 4232 wrote to memory of 3940 4232 b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exe cmd.exe PID 4232 wrote to memory of 3940 4232 b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exe cmd.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe PID 3732 wrote to memory of 1628 3732 netservice.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exe"C:\Users\Admin\AppData\Local\Temp\b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e.exe"2⤵
-
C:\Users\Admin\Favorites\netservice.exeC:\Users\Admin\Favorites\netservice.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" about:blank2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Favorites\netservice.exeFilesize
155KB
MD5d3bb560701d2b6ca0440c22c6679567e
SHA1d15f10faff11d1fbdc3bc2c6e114608ad1a177fd
SHA256b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e
SHA512b24da9cf07a263723f6ed7b3efab8129211de89b78e5b715add601f8dbffe57aebf45c54cd7c76a3b1127ee55334f082ba4652b4f86a0a40e7d13faf7f216bcd
-
C:\Users\Admin\Favorites\netservice.exeFilesize
155KB
MD5d3bb560701d2b6ca0440c22c6679567e
SHA1d15f10faff11d1fbdc3bc2c6e114608ad1a177fd
SHA256b6e042b0fa5559315c0500ad91d22e02ad9e1bbb86d277a4cdf934d6781f2b5e
SHA512b24da9cf07a263723f6ed7b3efab8129211de89b78e5b715add601f8dbffe57aebf45c54cd7c76a3b1127ee55334f082ba4652b4f86a0a40e7d13faf7f216bcd
-
memory/3732-136-0x0000000000400000-0x000000000045F208-memory.dmpFilesize
380KB
-
memory/3732-139-0x0000000010410000-0x0000000010465000-memory.dmpFilesize
340KB
-
memory/3732-142-0x0000000000400000-0x000000000045F208-memory.dmpFilesize
380KB
-
memory/3940-135-0x0000000000000000-mapping.dmp
-
memory/4232-132-0x0000000000400000-0x000000000045F208-memory.dmpFilesize
380KB
-
memory/4232-137-0x0000000000400000-0x000000000045F208-memory.dmpFilesize
380KB