Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 00:14
Static task
static1
Behavioral task
behavioral1
Sample
server.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
server.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
server.exe
-
Size
174KB
-
MD5
f524b3f80cdf6522ee17536d51079f1e
-
SHA1
d1e908a0d08d143027c99b4992d083d37410e06a
-
SHA256
16d794e7f97da1a35744d11253f23f0fe60203ef2ed090c83f6e2b322c61bdae
-
SHA512
60908219fe4b40b98d25f950c1e850ff6a9e47d5823a2b6df777f20f3edd8281b013d30bd52a3801bff90ba4028d22404467ea46d1dac1ced4efacd5aea63ae0
-
SSDEEP
3072:25l5SHLfLpygi+pyByB5LnRlshG05ZjZZ4vbABAGcdYRGuD2CsW:klSpy/aiyB5L0hj5i5uDpB
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral2/memory/3392-140-0x0000000010410000-0x000000001046D000-memory.dmp modiloader_stage2 behavioral2/memory/3392-141-0x0000000010410000-0x000000001046D000-memory.dmp modiloader_stage2 behavioral2/memory/3392-142-0x0000000010410000-0x000000001046D000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 520 netservice.exe -
resource yara_rule behavioral2/memory/520-137-0x0000000010410000-0x000000001046D000-memory.dmp upx behavioral2/memory/3392-140-0x0000000010410000-0x000000001046D000-memory.dmp upx behavioral2/memory/3392-141-0x0000000010410000-0x000000001046D000-memory.dmp upx behavioral2/memory/3392-142-0x0000000010410000-0x000000001046D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3548 server.exe 3548 server.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 520 netservice.exe Token: SeIncBasePriorityPrivilege 3392 svchost.exe Token: SeIncBasePriorityPrivilege 3392 svchost.exe Token: SeIncBasePriorityPrivilege 3392 svchost.exe Token: SeIncBasePriorityPrivilege 3392 svchost.exe Token: SeIncBasePriorityPrivilege 3392 svchost.exe Token: SeIncBasePriorityPrivilege 3392 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 756 3548 server.exe 80 PID 3548 wrote to memory of 756 3548 server.exe 80 PID 3548 wrote to memory of 756 3548 server.exe 80 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82 PID 520 wrote to memory of 3392 520 netservice.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵PID:756
-
-
C:\Users\Admin\Favorites\netservice.exeC:\Users\Admin\Favorites\netservice.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
174KB
MD5f524b3f80cdf6522ee17536d51079f1e
SHA1d1e908a0d08d143027c99b4992d083d37410e06a
SHA25616d794e7f97da1a35744d11253f23f0fe60203ef2ed090c83f6e2b322c61bdae
SHA51260908219fe4b40b98d25f950c1e850ff6a9e47d5823a2b6df777f20f3edd8281b013d30bd52a3801bff90ba4028d22404467ea46d1dac1ced4efacd5aea63ae0
-
Filesize
174KB
MD5f524b3f80cdf6522ee17536d51079f1e
SHA1d1e908a0d08d143027c99b4992d083d37410e06a
SHA25616d794e7f97da1a35744d11253f23f0fe60203ef2ed090c83f6e2b322c61bdae
SHA51260908219fe4b40b98d25f950c1e850ff6a9e47d5823a2b6df777f20f3edd8281b013d30bd52a3801bff90ba4028d22404467ea46d1dac1ced4efacd5aea63ae0