Analysis
-
max time kernel
90s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 09:10
Static task
static1
Behavioral task
behavioral1
Sample
9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe
Resource
win10v2004-20220901-en
General
-
Target
9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe
-
Size
640KB
-
MD5
9705ee27fa98efa1ea8abb42de8d5946
-
SHA1
1ad51958475571fb6b8401f67c89d572104c8292
-
SHA256
9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275
-
SHA512
e4ffdbb5545bc8fb9786d91b714b7e91144ad03ab96143280abad3298b4408bfa1a8ffe3c44a3ca91dbea76a07263d9420504aea74b393cde2c6e1624c743539
-
SSDEEP
12288:W7NDgoQihyEg+ecqyS7+cZ++NVFmFqgTIsnbm+bTwdsh9U2L5RE:WpDeOye1S7+0hVEFqsIsnbrnG2L5W
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4008-133-0x0000000000400000-0x00000000005B5000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exedescription pid process target process PID 4008 set thread context of 2640 4008 9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe IEXPLORE.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exedescription ioc process File created C:\Program Files\FieleWay.txt 9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{95279C4F-7548-11ED-A0EE-C65219BF0A09} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377083988" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1773933604" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1773933604" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000917" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1793464923" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000917" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000917" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid process 2640 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 2640 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exeIEXPLORE.EXEdescription pid process target process PID 4008 wrote to memory of 2640 4008 9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe IEXPLORE.EXE PID 4008 wrote to memory of 2640 4008 9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe IEXPLORE.EXE PID 4008 wrote to memory of 2640 4008 9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe IEXPLORE.EXE PID 2640 wrote to memory of 2384 2640 IEXPLORE.EXE IEXPLORE.EXE PID 2640 wrote to memory of 2384 2640 IEXPLORE.EXE IEXPLORE.EXE PID 2640 wrote to memory of 2384 2640 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe"C:\Users\Admin\AppData\Local\Temp\9df1dda509bc600784990066f2bd188b2bd956fc79d1fce1a70e56de1135f275.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5ac572cbbc82d6d652cdbe2596aeac4ee
SHA1a631b27cf33fe134f42ed411d7ea06c21df41ad5
SHA25650b6d8f62150a7bd25fb3e462130e8e054a0f1fb619487e8c426a4c8bf6bdca8
SHA512070095ec83e4eeccae5dcbadcb3132f08fd0aac50badbc42cb72691236b6cfcdf14ce275fb1bf5511896bb4dd25c2121e044341003c1a507be8fabc0b2b1bfff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD519e55a7bc5d11c362f0a373fab57939a
SHA1041c7bec38d460dfffd8f471f49a4e652eeec4f2
SHA2565d75adef0b94049cd288939d59d0fa65c45c6a6fee72a4e063bdc65ce0b8e463
SHA51242b688adfbd25e5f10120d58dd161bb3aa7d139f2c37b1f8e738be7338d4c2687c66070bc59535cfe7c1656b5731d4b6e81902ef125a033d57942271102b2090
-
memory/4008-132-0x0000000000400000-0x00000000005B5000-memory.dmpFilesize
1.7MB
-
memory/4008-133-0x0000000000400000-0x00000000005B5000-memory.dmpFilesize
1.7MB
-
memory/4008-134-0x00000000023D0000-0x0000000002424000-memory.dmpFilesize
336KB