Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 11:44
Behavioral task
behavioral1
Sample
Build1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Build1.exe
Resource
win10v2004-20240419-en
General
-
Target
Build1.exe
-
Size
18KB
-
MD5
a4b14b3833555e5a0687838bbea8553d
-
SHA1
fb2a65cd531bfb47023ce37dea1bae4e6f572ba3
-
SHA256
b4235f7583ae798d313b878ad9639a5646c04b45a1d9f43d1fa09c37163c6e78
-
SHA512
1ca5731abd0c157747e0df0a112b6ca9698937fef6e3d37d5608e1ad5292a68ba330a7cb809149e69ed02b5ff3e093cebeb965fb3f1b797a25d8134de968cb96
-
SSDEEP
384:rEw7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1Czcx4qhne:rEw7wkHOYEGPvCaV4pLzb1fx4
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2856-12-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1736-14-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
AdobeART.exepid process 1736 AdobeART.exe -
Loads dropped DLL 2 IoCs
Processes:
Build1.exepid process 2856 Build1.exe 2856 Build1.exe -
Processes:
resource yara_rule behavioral1/memory/2856-0-0x0000000000400000-0x0000000000414000-memory.dmp upx \Users\Admin\AppData\Roaming\AdobeART.exe upx behavioral1/memory/2856-12-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1736-13-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1736-14-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Build1.exedescription pid process target process PID 2856 wrote to memory of 1736 2856 Build1.exe AdobeART.exe PID 2856 wrote to memory of 1736 2856 Build1.exe AdobeART.exe PID 2856 wrote to memory of 1736 2856 Build1.exe AdobeART.exe PID 2856 wrote to memory of 1736 2856 Build1.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Build1.exe"C:\Users\Admin\AppData\Local\Temp\Build1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5a4b14b3833555e5a0687838bbea8553d
SHA1fb2a65cd531bfb47023ce37dea1bae4e6f572ba3
SHA256b4235f7583ae798d313b878ad9639a5646c04b45a1d9f43d1fa09c37163c6e78
SHA5121ca5731abd0c157747e0df0a112b6ca9698937fef6e3d37d5608e1ad5292a68ba330a7cb809149e69ed02b5ff3e093cebeb965fb3f1b797a25d8134de968cb96