Analysis
-
max time kernel
97s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 16:37
Static task
static1
Behavioral task
behavioral1
Sample
9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe
Resource
win10v2004-20220812-en
General
-
Target
9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe
-
Size
487KB
-
MD5
f3c99f387838d9b8ec318a42fc74182e
-
SHA1
4479698bfc9e884f833e4e4dad6dbf9d20832c55
-
SHA256
9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80
-
SHA512
933e9227ce53e38034301ab4c8c4794190c0c567bbce64a5c8ff88a172f3a954950d2123ba30754a61e4d3a7a3e55f891565d78e4268e8842c3c8dce62d063f0
-
SSDEEP
6144:80nDtmLMjvgmt2ojZ/BU8XLMmruOClyg1ukZ/A8BO0/4NuwE1pfiWagW:8ZLa2I/PX7ruOCljsKAJ0AkkKW
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1112-62-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral1/memory/1112-63-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral1/memory/1112-65-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1172 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/1112-57-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1112-59-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1112-61-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1112-62-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1112-63-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1112-65-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 1112 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exedescription pid process target process PID 1744 set thread context of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exevbc.exedescription pid process target process PID 1744 wrote to memory of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe PID 1744 wrote to memory of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe PID 1744 wrote to memory of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe PID 1744 wrote to memory of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe PID 1744 wrote to memory of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe PID 1744 wrote to memory of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe PID 1744 wrote to memory of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe PID 1744 wrote to memory of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe PID 1744 wrote to memory of 1112 1744 9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe vbc.exe PID 1112 wrote to memory of 1172 1112 vbc.exe svchost.exe PID 1112 wrote to memory of 1172 1112 vbc.exe svchost.exe PID 1112 wrote to memory of 1172 1112 vbc.exe svchost.exe PID 1112 wrote to memory of 1172 1112 vbc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe"C:\Users\Admin\AppData\Local\Temp\9cef1abb5b1c8cb9c46aacce924a581e5f6f22f6a94d40909c0d724de27a2a80.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Services\svchost.exe"C:\Users\Admin\Documents\Services\svchost.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\Services\svchost.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\Documents\Services\svchost.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\Documents\Services\svchost.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/1112-61-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1112-58-0x000000000041F000-mapping.dmp
-
memory/1112-59-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1112-62-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1112-63-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1112-65-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1112-57-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1172-67-0x0000000000000000-mapping.dmp
-
memory/1744-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1744-64-0x0000000000146000-0x0000000000157000-memory.dmpFilesize
68KB
-
memory/1744-56-0x0000000074BB0000-0x000000007515B000-memory.dmpFilesize
5.7MB
-
memory/1744-55-0x0000000074BB0000-0x000000007515B000-memory.dmpFilesize
5.7MB