Analysis
-
max time kernel
142s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 20:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02f2cf085e68878772b165fd8f08fb9d.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
02f2cf085e68878772b165fd8f08fb9d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
02f2cf085e68878772b165fd8f08fb9d.exe
-
Size
164KB
-
MD5
02f2cf085e68878772b165fd8f08fb9d
-
SHA1
c21ec6af7b6803f2318b2977be23ee6d4a1458d2
-
SHA256
ee8bb17b29c350019de834663898767f6a2e53341b5af7d606ecd9c6b8f5e4aa
-
SHA512
9aca6130a91ea90e5bbcd9a8f57b7a803a77d54bf119dd8f6bacf0bde1f6759f4c8406e79656da65fc636a9787ff1bec0ec841903dff562b21d930369d6fd043
-
SSDEEP
3072:amZXdmmXxLg7GkK4ymIpaKjfFMFZt4+4SqyR+6yiO+NrVFxp/r/RGLOfx:amHHRdkhgaQfQCDxyR+zidVpDRrJ
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral1/memory/2600-7-0x0000000013140000-0x00000000131CB000-memory.dmp modiloader_stage2 behavioral1/memory/2208-164-0x0000000013140000-0x00000000131CB000-memory.dmp modiloader_stage2 behavioral1/memory/2640-165-0x0000000010410000-0x000000001046F000-memory.dmp modiloader_stage2 behavioral1/memory/2208-169-0x0000000013140000-0x00000000131CB000-memory.dmp modiloader_stage2 behavioral1/memory/2640-170-0x0000000010410000-0x000000001046F000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2748 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2208 netservice.exe -
resource yara_rule behavioral1/memory/2640-165-0x0000000010410000-0x000000001046F000-memory.dmp upx behavioral1/memory/2640-170-0x0000000010410000-0x000000001046F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2208 netservice.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2600 wrote to memory of 2748 2600 02f2cf085e68878772b165fd8f08fb9d.exe 29 PID 2600 wrote to memory of 2748 2600 02f2cf085e68878772b165fd8f08fb9d.exe 29 PID 2600 wrote to memory of 2748 2600 02f2cf085e68878772b165fd8f08fb9d.exe 29 PID 2600 wrote to memory of 2748 2600 02f2cf085e68878772b165fd8f08fb9d.exe 29 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31 PID 2208 wrote to memory of 2640 2208 netservice.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\02f2cf085e68878772b165fd8f08fb9d.exe"C:\Users\Admin\AppData\Local\Temp\02f2cf085e68878772b165fd8f08fb9d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\02f2cf085e68878772b165fd8f08fb9d.exe"2⤵
- Deletes itself
PID:2748
-
-
C:\Users\Admin\Favorites\netservice.exeC:\Users\Admin\Favorites\netservice.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe2⤵PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD502f2cf085e68878772b165fd8f08fb9d
SHA1c21ec6af7b6803f2318b2977be23ee6d4a1458d2
SHA256ee8bb17b29c350019de834663898767f6a2e53341b5af7d606ecd9c6b8f5e4aa
SHA5129aca6130a91ea90e5bbcd9a8f57b7a803a77d54bf119dd8f6bacf0bde1f6759f4c8406e79656da65fc636a9787ff1bec0ec841903dff562b21d930369d6fd043