Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:29
Behavioral task
behavioral1
Sample
751883053650b7f8396e3ed66337a225.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
751883053650b7f8396e3ed66337a225.exe
Resource
win10v2004-20231215-en
General
-
Target
751883053650b7f8396e3ed66337a225.exe
-
Size
90KB
-
MD5
751883053650b7f8396e3ed66337a225
-
SHA1
204330df5796046933669247c56f546bbfa1449e
-
SHA256
519a8c7261620400ceff2caa51b22b53bd458e3db948dea06e67a7862883bef3
-
SHA512
aa89c32df49d0bc16769d51a6def84748b75f968d9f8e3267f408c176520b1131a420231079438b39255fbcf796f3a034b7dcc9fbeebfc6cc4d93a65213af144
-
SSDEEP
1536:hcHA5dZuvrKA1r4Jwwi55dlvo89UBYKpJ0pHWG7m9pAsiyRsUuh8iO70Qdc6mQ:hcg7UrKqUwflAZYKX6aAsiyunQb
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 15 IoCs
Processes:
resource yara_rule behavioral2/memory/2200-10-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-12-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-13-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-14-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-15-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-16-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-17-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-18-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-19-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-20-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-21-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-22-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-23-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-24-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral2/memory/1236-25-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
751883053650b7f8396e3ed66337a225.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 751883053650b7f8396e3ed66337a225.exe -
Deletes itself 1 IoCs
Processes:
msmgrs.exepid process 1236 msmgrs.exe -
Drops startup file 2 IoCs
Processes:
msmgrs.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk msmgrs.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk msmgrs.exe -
Executes dropped EXE 1 IoCs
Processes:
msmgrs.exepid process 1236 msmgrs.exe -
Processes:
resource yara_rule behavioral2/memory/2200-0-0x0000000000400000-0x000000000043C000-memory.dmp upx C:\Windows\SysWOW64\wins\setup\msmgrs.exe upx behavioral2/memory/2200-10-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-8-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-12-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-13-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-14-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-15-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-16-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-17-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-18-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-19-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-20-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-21-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-22-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-23-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-24-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/1236-25-0x0000000000400000-0x000000000043C000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
751883053650b7f8396e3ed66337a225.exedescription ioc process File created C:\Windows\SysWOW64\wins\setup\msmgrs.exe 751883053650b7f8396e3ed66337a225.exe File opened for modification C:\Windows\SysWOW64\wins\setup\msmgrs.exe 751883053650b7f8396e3ed66337a225.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
751883053650b7f8396e3ed66337a225.exemsmgrs.exepid process 2200 751883053650b7f8396e3ed66337a225.exe 2200 751883053650b7f8396e3ed66337a225.exe 1236 msmgrs.exe 1236 msmgrs.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
751883053650b7f8396e3ed66337a225.exemsmgrs.execmd.execmd.exedescription pid process target process PID 2200 wrote to memory of 1236 2200 751883053650b7f8396e3ed66337a225.exe msmgrs.exe PID 2200 wrote to memory of 1236 2200 751883053650b7f8396e3ed66337a225.exe msmgrs.exe PID 2200 wrote to memory of 1236 2200 751883053650b7f8396e3ed66337a225.exe msmgrs.exe PID 1236 wrote to memory of 2616 1236 msmgrs.exe cmd.exe PID 1236 wrote to memory of 2616 1236 msmgrs.exe cmd.exe PID 1236 wrote to memory of 2616 1236 msmgrs.exe cmd.exe PID 1236 wrote to memory of 3584 1236 msmgrs.exe cmd.exe PID 1236 wrote to memory of 3584 1236 msmgrs.exe cmd.exe PID 1236 wrote to memory of 3584 1236 msmgrs.exe cmd.exe PID 2616 wrote to memory of 2140 2616 cmd.exe regsvr32.exe PID 2616 wrote to memory of 2140 2616 cmd.exe regsvr32.exe PID 2616 wrote to memory of 2140 2616 cmd.exe regsvr32.exe PID 3584 wrote to memory of 1880 3584 cmd.exe regsvr32.exe PID 3584 wrote to memory of 1880 3584 cmd.exe regsvr32.exe PID 3584 wrote to memory of 1880 3584 cmd.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\751883053650b7f8396e3ed66337a225.exe"C:\Users\Admin\AppData\Local\Temp\751883053650b7f8396e3ed66337a225.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\wins\setup\msmgrs.exe"C:\Windows\system32\wins\setup\msmgrs.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEditControl.dll3⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEditControl.dll4⤵PID:2140
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/tebedit.ocx3⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/tebedit.ocx4⤵PID:1880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5751883053650b7f8396e3ed66337a225
SHA1204330df5796046933669247c56f546bbfa1449e
SHA256519a8c7261620400ceff2caa51b22b53bd458e3db948dea06e67a7862883bef3
SHA512aa89c32df49d0bc16769d51a6def84748b75f968d9f8e3267f408c176520b1131a420231079438b39255fbcf796f3a034b7dcc9fbeebfc6cc4d93a65213af144