Overview

overview

10

Static

static

10

2dd9d56cd3...89.exe

windows7-x64

10

2dd9d56cd3...89.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2023 16:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2dd9d56cd332bb42e5bc53c94aeeff89.exe

  • Size

    856KB

  • MD5

    2dd9d56cd332bb42e5bc53c94aeeff89

  • SHA1

    0164f209b285f68f74450306fda7752aa123378d

  • SHA256

    6639219e3638a6530ebac109e3d1443164aad6ab97b0c82c904f676a816018b5

  • SHA512

    daebb6fdc69fe21fd8c11b51b2d62d72cf9e1db36711717f560457ac1f35538d254f17f6ab45f678e8a920ceb719e705648ef393edaa869df39f4d256e694c89

  • SSDEEP

    12288:cJjCWhgzbBW8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgPpPikA43xsr4Y2a6A2nChuUr

Score
10/10
modiloaderevasionpersistencetrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • ModiLoader Second Stage 9 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3568
    • C:\Users\Admin\AppData\Local\Temp\2dd9d56cd332bb42e5bc53c94aeeff89.exe
      "C:\Users\Admin\AppData\Local\Temp\2dd9d56cd332bb42e5bc53c94aeeff89.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Users\Admin\AppData\Local\Temp\2dd9d56cd332bb42e5bc53c94aeeff89.exe
        2dd9d56cd332bb42e5bc53c94aeeff89.exe
        3⤵
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1652
        • C:\Users\Admin\HM23Yh.exe
          C:\Users\Admin\HM23Yh.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:216
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1140
          • C:\Users\Admin\yuiyec.exe
            "C:\Users\Admin\yuiyec.exe"
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:3208
        • C:\Users\Admin\awhost.exe
          C:\Users\Admin\awhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4284
          • C:\Users\Admin\awhost.exe
            awhost.exe
            5⤵
            • Executes dropped EXE
            • Maps connected drives based on registry
            • Suspicious behavior: EnumeratesProcesses
            PID:3640
        • C:\Users\Admin\bwhost.exe
          C:\Users\Admin\bwhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3300
          • C:\Users\Admin\bwhost.exe
            bwhost.exe
            5⤵
            • Executes dropped EXE
            • Maps connected drives based on registry
            • Suspicious behavior: EnumeratesProcesses
            PID:1144
        • C:\Users\Admin\cwhost.exe
          C:\Users\Admin\cwhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4956
          • C:\Windows\explorer.exe
            000001D8*
            5⤵
              PID:3860
          • C:\Users\Admin\dwhost.exe
            C:\Users\Admin\dwhost.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4508
            • C:\Users\Admin\AppData\Local\ad0c643d\X
              193.105.154.210:80
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3064
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe"
              5⤵
                PID:4956
            • C:\Users\Admin\ewhost.exe
              C:\Users\Admin\ewhost.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2408
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c tasklist&&del 2dd9d56cd332bb42e5bc53c94aeeff89.exe
              4⤵
                PID:4236
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          1⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:5008
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          1⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1964

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\ad0c643d\X
          Filesize

          41KB

          MD5

          686b479b0ee164cf1744a8be359ebb7d

          SHA1

          8615e8f967276a85110b198d575982a958581a07

          SHA256

          fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

          SHA512

          7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

          Download Submit

        • C:\Users\Admin\awhost.exe
          Filesize

          270KB

          MD5

          5efdb148d618a6b6d2369fccd60f4212

          SHA1

          7e2045b55c33af87848088738215af2bf7ad0b9b

          SHA256

          db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b

          SHA512

          e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21

          Download Submit

        • C:\Users\Admin\bwhost.exe
          Filesize

          157KB

          MD5

          2dd258fd2e5a7fccd81b8af93c08780b

          SHA1

          a5373acdb7f4684b032954e9e754593ddcc827b2

          SHA256

          00d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9

          SHA512

          20048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df

          Download Submit

        • C:\Users\Admin\cwhost.exe
          Filesize

          150KB

          MD5

          d91ada984db5e7adbf2b80c2284c12f6

          SHA1

          31e9b27095ac041687b016006f41ea6e5222202d

          SHA256

          8cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948

          SHA512

          8a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748

          Download Submit

        • C:\Users\Admin\dwhost.exe
          Filesize

          333KB

          MD5

          1aceb282a6d05fcc08f3f74f5483bf0a

          SHA1

          778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b

          SHA256

          d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d

          SHA512

          5f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8

          Download Submit

        • C:\Users\Admin\dwhost.exe
          Filesize

          200KB

          MD5

          1cd306e67aae6aa5d134f35bc488f123

          SHA1

          63e7e9eea9c4dab954468c292c7f8ac8acaced5d

          SHA256

          701ca768b6024db5599e135cca4a456d9dc3664bb82d48102d9ff1c3840700eb

          SHA512

          7d130fc7810f1a39114e2a2451e699ddf18e37792421461c775682c55b5f44a518b4df33d40c948a1169a87a297a56920a9c43ef82d97e121196559444ec881e

          Download Submit

        • C:\Users\Admin\ewhost.exe
          Filesize

          36KB

          MD5

          4bcd12fdaa17197a658a5113af9120ec

          SHA1

          3ac79b0b793e390cf1dea82c1754ec34aab1ea46

          SHA256

          e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96

          SHA512

          dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd

          Download Submit

        • C:\Users\Admin\yuiyec.exe
          Filesize

          224KB

          MD5

          30223787b38b0c250465d41f39b23fbb

          SHA1

          e6acee58e55d61b569fabf7e719aef417683bf67

          SHA256

          846d27fef7ee842c659facfce4be2140dc8c70eccf48b3830b7f908f6c69cbd9

          SHA512

          89bfe6d2057d033b1abe5079167b5e748b13c5a32c6c07e4d7e4562641783628d1d4d475320f036a74bace7e4a8880c64bb1002623570af12c7676763844d77a

          Download Submit

        • memory/1144-103-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

          Download

        • memory/1144-77-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

          Download

        • memory/1144-76-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

          Download

        • memory/1144-73-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

          Download

        • memory/1144-67-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

          Download

        • memory/1144-66-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

          Download

        • memory/1652-74-0x0000000000400000-0x000000000052D000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/1652-126-0x0000000000400000-0x000000000052D000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/1652-0-0x0000000000400000-0x000000000052D000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/1652-5-0x0000000000400000-0x000000000052D000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/1652-6-0x0000000000400000-0x000000000052D000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/1652-1-0x0000000000400000-0x000000000052D000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/1652-7-0x0000000000400000-0x000000000052D000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/3300-72-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/3568-125-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/3640-54-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

          Download

        • memory/3640-53-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

          Download

        • memory/3640-55-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

          Download

        • memory/3640-56-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

          Download

        • memory/3640-101-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

          Download

        • memory/3640-62-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

          Download

        • memory/3640-57-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

          Download

        • memory/3732-3-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3860-89-0x0000000000F70000-0x0000000000F85000-memory.dmp

          Filesize

          84KB

          Download

        • memory/4284-61-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/4508-98-0x0000000000800000-0x0000000000900000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/4508-94-0x0000000000400000-0x0000000000462FF0-memory.dmp

          Filesize

          395KB

          Download

        • memory/4508-104-0x0000000000400000-0x0000000000462FF0-memory.dmp

          Filesize

          395KB

          Download

        • memory/4508-110-0x0000000000400000-0x0000000000462FF0-memory.dmp

          Filesize

          395KB

          Download

        • memory/4956-87-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

          Download

        • memory/4956-86-0x00000000005B3000-0x00000000005B4000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4956-85-0x00000000005B0000-0x00000000005F4000-memory.dmp

          Filesize

          272KB

          Download

        • memory/4956-84-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

          Download

        • memory/4956-82-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

          Download

        • memory/4956-83-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

          Download

        • memory/4956-81-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

          Download