Analysis
-
max time kernel
105s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 13:36
Static task
static1
Behavioral task
behavioral1
Sample
f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe
Resource
win10v2004-20221111-en
General
-
Target
f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe
-
Size
401KB
-
MD5
af96fc74c498c6567346bdc3d1fdcb02
-
SHA1
3dfd54efbd86bf37be09a6a203dd75543e2d0499
-
SHA256
f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023
-
SHA512
c2730cc5ef8bd8f6844e998c0ca37744aefae6cd20d7003f11b6301eeb9e556d0cd92b34084c946ea10e17ddb8a93925fd019c7d1ab4bd79e30d31f32dfe9602
-
SSDEEP
12288:AoZsctbM7a1V8RQf7K/p5erHc2BPau8Q/:Ao3QI7Kx5er82J
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1544-55-0x0000000000400000-0x0000000000526000-memory.dmp modiloader_stage2 behavioral1/memory/1544-56-0x0000000000401000-0x000000000049B000-memory.dmp modiloader_stage2 behavioral1/memory/1544-57-0x0000000000400000-0x0000000000526000-memory.dmp modiloader_stage2 behavioral1/memory/1544-58-0x0000000000400000-0x0000000000526000-memory.dmp modiloader_stage2 behavioral1/memory/1544-65-0x0000000003030000-0x0000000003156000-memory.dmp modiloader_stage2 behavioral1/memory/936-66-0x0000000000400000-0x0000000000526000-memory.dmp modiloader_stage2 behavioral1/memory/1544-68-0x0000000000400000-0x0000000000526000-memory.dmp modiloader_stage2 behavioral1/memory/936-69-0x0000000000400000-0x0000000000526000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
360.exepid process 936 360.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 680 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exepid process 1544 f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe -
Drops file in Program Files directory 2 IoCs
Processes:
f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exedescription ioc process File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\360.exe f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe File created C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\360.exe f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exedescription pid process target process PID 1544 wrote to memory of 936 1544 f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe 360.exe PID 1544 wrote to memory of 936 1544 f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe 360.exe PID 1544 wrote to memory of 936 1544 f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe 360.exe PID 1544 wrote to memory of 936 1544 f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe 360.exe PID 1544 wrote to memory of 680 1544 f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe cmd.exe PID 1544 wrote to memory of 680 1544 f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe cmd.exe PID 1544 wrote to memory of 680 1544 f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe cmd.exe PID 1544 wrote to memory of 680 1544 f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe"C:\Users\Admin\AppData\Local\Temp\f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\360.exeC:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\360.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023.exe"2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\360.exeFilesize
401KB
MD5af96fc74c498c6567346bdc3d1fdcb02
SHA13dfd54efbd86bf37be09a6a203dd75543e2d0499
SHA256f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023
SHA512c2730cc5ef8bd8f6844e998c0ca37744aefae6cd20d7003f11b6301eeb9e556d0cd92b34084c946ea10e17ddb8a93925fd019c7d1ab4bd79e30d31f32dfe9602
-
\PROGRA~1\COMMON~1\MICROS~1\MSInfo\360.exeFilesize
401KB
MD5af96fc74c498c6567346bdc3d1fdcb02
SHA13dfd54efbd86bf37be09a6a203dd75543e2d0499
SHA256f648a4e352e8beb3c2fbc65780fe4e7c2739245e79985380aab01eef398a5023
SHA512c2730cc5ef8bd8f6844e998c0ca37744aefae6cd20d7003f11b6301eeb9e556d0cd92b34084c946ea10e17ddb8a93925fd019c7d1ab4bd79e30d31f32dfe9602
-
memory/680-67-0x0000000000000000-mapping.dmp
-
memory/936-66-0x0000000000400000-0x0000000000526000-memory.dmpFilesize
1.1MB
-
memory/936-60-0x0000000000000000-mapping.dmp
-
memory/936-69-0x0000000000400000-0x0000000000526000-memory.dmpFilesize
1.1MB
-
memory/1544-58-0x0000000000400000-0x0000000000526000-memory.dmpFilesize
1.1MB
-
memory/1544-57-0x0000000000400000-0x0000000000526000-memory.dmpFilesize
1.1MB
-
memory/1544-56-0x0000000000401000-0x000000000049B000-memory.dmpFilesize
616KB
-
memory/1544-65-0x0000000003030000-0x0000000003156000-memory.dmpFilesize
1.1MB
-
memory/1544-54-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/1544-55-0x0000000000400000-0x0000000000526000-memory.dmpFilesize
1.1MB
-
memory/1544-68-0x0000000000400000-0x0000000000526000-memory.dmpFilesize
1.1MB