Analysis
-
max time kernel
159s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 11:47
Static task
static1
Behavioral task
behavioral1
Sample
e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe
Resource
win10v2004-20221111-en
General
-
Target
e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe
-
Size
54KB
-
MD5
9e0cb74cc8287fec3ef9ec4ddbd0f31c
-
SHA1
3f8f6cd4841bf2109bac9b0c3a0eeb84d08e613b
-
SHA256
e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd
-
SHA512
c7f3b7a6af4d5e7e603c3ffeee4461839c64ecffcba3fb3923cbf034c8f650a79547ff167aef7cb933cd81b814d6fbf9e972e725ff04cb040be00dd81b062983
-
SSDEEP
768:jZdny1ts1joc8rtv0CHJ2abKi/tnlS2CTaeldCjXiXxaUDpzJJ2HNpF/U:jZoioc8t1J2qtnlSbT/30ihaOzJAtc
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 13 IoCs
Processes:
resource yara_rule behavioral1/memory/1140-57-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1140-58-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1140-59-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1140-60-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1140-61-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1140-62-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1140-63-0x00000000004082E8-mapping.dmp modiloader_stage2 behavioral1/memory/1140-64-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1140-66-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1140-71-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1500-82-0x00000000004082E8-mapping.dmp modiloader_stage2 behavioral1/memory/1500-86-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral1/memory/1500-87-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
AcerOle.exeAcerOle.exepid process 2020 AcerOle.exe 1500 AcerOle.exe -
Loads dropped DLL 2 IoCs
Processes:
e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exepid process 1140 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe 1140 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AcerOle.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Ole Product = "C:\\Users\\Admin\\AppData\\Roaming\\AcerOle.exe" AcerOle.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exeAcerOle.exedescription pid process target process PID 956 set thread context of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 2020 set thread context of 1500 2020 AcerOle.exe AcerOle.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exee6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exeAcerOle.exedescription pid process target process PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 956 wrote to memory of 1140 956 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe PID 1140 wrote to memory of 2020 1140 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe AcerOle.exe PID 1140 wrote to memory of 2020 1140 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe AcerOle.exe PID 1140 wrote to memory of 2020 1140 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe AcerOle.exe PID 1140 wrote to memory of 2020 1140 e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe PID 2020 wrote to memory of 1500 2020 AcerOle.exe AcerOle.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe"C:\Users\Admin\AppData\Local\Temp\e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe"C:\Users\Admin\AppData\Local\Temp\e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Roaming\AcerOle.exe"C:\Users\Admin\AppData\Roaming\AcerOle.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Roaming\AcerOle.exe"C:\Users\Admin\AppData\Roaming\AcerOle.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1500
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AcerOle.exeFilesize
54KB
MD59e0cb74cc8287fec3ef9ec4ddbd0f31c
SHA13f8f6cd4841bf2109bac9b0c3a0eeb84d08e613b
SHA256e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd
SHA512c7f3b7a6af4d5e7e603c3ffeee4461839c64ecffcba3fb3923cbf034c8f650a79547ff167aef7cb933cd81b814d6fbf9e972e725ff04cb040be00dd81b062983
-
C:\Users\Admin\AppData\Roaming\AcerOle.exeFilesize
54KB
MD59e0cb74cc8287fec3ef9ec4ddbd0f31c
SHA13f8f6cd4841bf2109bac9b0c3a0eeb84d08e613b
SHA256e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd
SHA512c7f3b7a6af4d5e7e603c3ffeee4461839c64ecffcba3fb3923cbf034c8f650a79547ff167aef7cb933cd81b814d6fbf9e972e725ff04cb040be00dd81b062983
-
C:\Users\Admin\AppData\Roaming\AcerOle.exeFilesize
54KB
MD59e0cb74cc8287fec3ef9ec4ddbd0f31c
SHA13f8f6cd4841bf2109bac9b0c3a0eeb84d08e613b
SHA256e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd
SHA512c7f3b7a6af4d5e7e603c3ffeee4461839c64ecffcba3fb3923cbf034c8f650a79547ff167aef7cb933cd81b814d6fbf9e972e725ff04cb040be00dd81b062983
-
\Users\Admin\AppData\Roaming\AcerOle.exeFilesize
54KB
MD59e0cb74cc8287fec3ef9ec4ddbd0f31c
SHA13f8f6cd4841bf2109bac9b0c3a0eeb84d08e613b
SHA256e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd
SHA512c7f3b7a6af4d5e7e603c3ffeee4461839c64ecffcba3fb3923cbf034c8f650a79547ff167aef7cb933cd81b814d6fbf9e972e725ff04cb040be00dd81b062983
-
\Users\Admin\AppData\Roaming\AcerOle.exeFilesize
54KB
MD59e0cb74cc8287fec3ef9ec4ddbd0f31c
SHA13f8f6cd4841bf2109bac9b0c3a0eeb84d08e613b
SHA256e6fc13765f7c596e9522cf88ba0fbd2605fd07ecc72c03cd0c67ade92e76d4bd
SHA512c7f3b7a6af4d5e7e603c3ffeee4461839c64ecffcba3fb3923cbf034c8f650a79547ff167aef7cb933cd81b814d6fbf9e972e725ff04cb040be00dd81b062983
-
memory/1140-65-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1140-59-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-62-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-63-0x00000000004082E8-mapping.dmp
-
memory/1140-64-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-54-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-66-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-60-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-71-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-61-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-55-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-58-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1140-57-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1500-82-0x00000000004082E8-mapping.dmp
-
memory/1500-86-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1500-87-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2020-69-0x0000000000000000-mapping.dmp