Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 13:33
Static task
static1
Behavioral task
behavioral1
Sample
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe
Resource
win10v2004-20220901-en
General
-
Target
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe
-
Size
280KB
-
MD5
e77dda259712f46ddaeb45e1831d28d9
-
SHA1
d1ee751682682038ece87f90958f7d5df9648589
-
SHA256
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb
-
SHA512
7b36a7948b9c475e46945e2a6c66ab6fb967696ca038b015492a7966f93222d4b01e8948c990750af69a3890fff8d5fd9e7a44c4d3b3d4761eaa6badc0a6dcdd
-
SSDEEP
6144:zHCji47tHVsr54+eoKN8j/9ofYb3wLLBvfyg4yJpT221:Oicmr5gbNGgYjefy7yJpT24
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3400-145-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral2/memory/3400-146-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral2/memory/3400-147-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral2/memory/3400-149-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 behavioral2/memory/3400-152-0x0000000000400000-0x0000000000433000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exeadobeupdater.exepid process 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe 2352 adobeupdater.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe -
Loads dropped DLL 3 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exepid process 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VcsTTiYbTsVzxfUofWjudcQQrzMoInLdpdbVnkHqCHEPghDENl = "C:\\Users\\Admin\\AppData\\Local\\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe" c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exedescription pid process target process PID 4188 set thread context of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
vbc.exedescription ioc process File created C:\Windows\adobeupdater.exe vbc.exe File opened for modification C:\Windows\adobeupdater.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 3400 vbc.exe 3400 vbc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exec573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exevbc.exedescription pid process target process PID 4412 wrote to memory of 4188 4412 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe PID 4412 wrote to memory of 4188 4412 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe PID 4412 wrote to memory of 4188 4412 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 4188 wrote to memory of 3400 4188 c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe vbc.exe PID 3400 wrote to memory of 2352 3400 vbc.exe adobeupdater.exe PID 3400 wrote to memory of 2352 3400 vbc.exe adobeupdater.exe PID 3400 wrote to memory of 2352 3400 vbc.exe adobeupdater.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe"C:\Users\Admin\AppData\Local\Temp\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe"C:\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\adobeupdater.exe"C:\Windows\adobeupdater.exe" \melt "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exe.logFilesize
319B
MD5600936e187ce94453648a9245b2b42a5
SHA13349e5da3f713259244a2cbcb4a9dca777f637ed
SHA2561493eb1dc75a64eb2eb06bc9eb2c864b78fc4a2c674108d5183ac7824013ff2d
SHA512d41203f93ed77430dc570e82dc713f09d21942d75d1f9c3c84135421550ac2fa3845b7e46df70d2c57fe97d3a88e43c672771bb8b6433c44584c4e64646c1964
-
C:\Users\Admin\AppData\Roaming\Twain.dllFilesize
18KB
MD52153e2d85da316a0fe302227e0f9af88
SHA148b334c27d604ce7d89c9c825d211d26427176cf
SHA256645b30a3ef5cf05ad0df575fbbdbc05387b5493ce1778935b60d98681fea7bc0
SHA512647b0b95622c2e9086f072ccf110371b38953619b4cb6697e259165ce12e0dd1854bc6351abb8f693d052d730f8790d72929a8c822a26ac369c372478c1e4fac
-
C:\Users\Admin\AppData\Roaming\Twain.dllFilesize
18KB
MD52153e2d85da316a0fe302227e0f9af88
SHA148b334c27d604ce7d89c9c825d211d26427176cf
SHA256645b30a3ef5cf05ad0df575fbbdbc05387b5493ce1778935b60d98681fea7bc0
SHA512647b0b95622c2e9086f072ccf110371b38953619b4cb6697e259165ce12e0dd1854bc6351abb8f693d052d730f8790d72929a8c822a26ac369c372478c1e4fac
-
C:\Users\Admin\AppData\Roaming\Twain.dllFilesize
18KB
MD52153e2d85da316a0fe302227e0f9af88
SHA148b334c27d604ce7d89c9c825d211d26427176cf
SHA256645b30a3ef5cf05ad0df575fbbdbc05387b5493ce1778935b60d98681fea7bc0
SHA512647b0b95622c2e9086f072ccf110371b38953619b4cb6697e259165ce12e0dd1854bc6351abb8f693d052d730f8790d72929a8c822a26ac369c372478c1e4fac
-
C:\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exeFilesize
280KB
MD5e77dda259712f46ddaeb45e1831d28d9
SHA1d1ee751682682038ece87f90958f7d5df9648589
SHA256c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb
SHA5127b36a7948b9c475e46945e2a6c66ab6fb967696ca038b015492a7966f93222d4b01e8948c990750af69a3890fff8d5fd9e7a44c4d3b3d4761eaa6badc0a6dcdd
-
C:\Users\Admin\AppData\Roaming\c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb.exeFilesize
280KB
MD5e77dda259712f46ddaeb45e1831d28d9
SHA1d1ee751682682038ece87f90958f7d5df9648589
SHA256c573204ab60f0660e5e543793495315a16ab78ae8b1faa68cd470b307322b3cb
SHA5127b36a7948b9c475e46945e2a6c66ab6fb967696ca038b015492a7966f93222d4b01e8948c990750af69a3890fff8d5fd9e7a44c4d3b3d4761eaa6badc0a6dcdd
-
C:\Windows\adobeupdater.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Windows\adobeupdater.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/2352-150-0x0000000000000000-mapping.dmp
-
memory/3400-149-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3400-144-0x0000000000000000-mapping.dmp
-
memory/3400-145-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3400-146-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3400-147-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3400-152-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4188-148-0x0000000074D00000-0x00000000752B1000-memory.dmpFilesize
5.7MB
-
memory/4188-143-0x0000000074D00000-0x00000000752B1000-memory.dmpFilesize
5.7MB
-
memory/4188-134-0x0000000000000000-mapping.dmp
-
memory/4412-133-0x0000000074D00000-0x00000000752B1000-memory.dmpFilesize
5.7MB
-
memory/4412-139-0x0000000074D00000-0x00000000752B1000-memory.dmpFilesize
5.7MB