Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 23:24
Behavioral task
behavioral1
Sample
2ff74a834f9c8676d286b82906ab1220_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2ff74a834f9c8676d286b82906ab1220_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
2ff74a834f9c8676d286b82906ab1220_NEAS.exe
-
Size
130KB
-
MD5
2ff74a834f9c8676d286b82906ab1220
-
SHA1
d129238dc1ca22edbcec4e988953e804a85b58cb
-
SHA256
7ee1daa144b52f42e36565ad54e25848377eef3ad92f985e6725f5646b5e71cd
-
SHA512
942e60c841020c1d7ef81f0e59c99b21730a9f1cabde4fce869bfb4693a06befe88e235939341ee719fd0d1f8548a93fc849eb43c42967ce3af639bd7451a431
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZG:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2396-44-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2396-49-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2396-47-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2396-53-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2396-55-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2396-59-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2ff74a834f9c8676d286b82906ab1220_NEAS.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 2ff74a834f9c8676d286b82906ab1220_NEAS.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 2284 Flaseher.exe 4676 Flaseher.exe 2396 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/1560-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1700-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1700-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1560-12-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1700-10-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/2284-36-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2284-39-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2284-40-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2284-50-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1700-57-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4676-58-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2ff74a834f9c8676d286b82906ab1220_NEAS.exeFlaseher.exedescription pid process target process PID 1560 set thread context of 1700 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2ff74a834f9c8676d286b82906ab1220_NEAS.exe PID 2284 set thread context of 4676 2284 Flaseher.exe Flaseher.exe PID 2284 set thread context of 2396 2284 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
2ff74a834f9c8676d286b82906ab1220_NEAS.exe2ff74a834f9c8676d286b82906ab1220_NEAS.exeFlaseher.exeFlaseher.exepid process 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 1700 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2284 Flaseher.exe 4676 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
2ff74a834f9c8676d286b82906ab1220_NEAS.exe2ff74a834f9c8676d286b82906ab1220_NEAS.execmd.exeFlaseher.exedescription pid process target process PID 1560 wrote to memory of 1700 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2ff74a834f9c8676d286b82906ab1220_NEAS.exe PID 1560 wrote to memory of 1700 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2ff74a834f9c8676d286b82906ab1220_NEAS.exe PID 1560 wrote to memory of 1700 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2ff74a834f9c8676d286b82906ab1220_NEAS.exe PID 1560 wrote to memory of 1700 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2ff74a834f9c8676d286b82906ab1220_NEAS.exe PID 1560 wrote to memory of 1700 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2ff74a834f9c8676d286b82906ab1220_NEAS.exe PID 1560 wrote to memory of 1700 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2ff74a834f9c8676d286b82906ab1220_NEAS.exe PID 1560 wrote to memory of 1700 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2ff74a834f9c8676d286b82906ab1220_NEAS.exe PID 1560 wrote to memory of 1700 1560 2ff74a834f9c8676d286b82906ab1220_NEAS.exe 2ff74a834f9c8676d286b82906ab1220_NEAS.exe PID 1700 wrote to memory of 3616 1700 2ff74a834f9c8676d286b82906ab1220_NEAS.exe cmd.exe PID 1700 wrote to memory of 3616 1700 2ff74a834f9c8676d286b82906ab1220_NEAS.exe cmd.exe PID 1700 wrote to memory of 3616 1700 2ff74a834f9c8676d286b82906ab1220_NEAS.exe cmd.exe PID 3616 wrote to memory of 1556 3616 cmd.exe reg.exe PID 3616 wrote to memory of 1556 3616 cmd.exe reg.exe PID 3616 wrote to memory of 1556 3616 cmd.exe reg.exe PID 1700 wrote to memory of 2284 1700 2ff74a834f9c8676d286b82906ab1220_NEAS.exe Flaseher.exe PID 1700 wrote to memory of 2284 1700 2ff74a834f9c8676d286b82906ab1220_NEAS.exe Flaseher.exe PID 1700 wrote to memory of 2284 1700 2ff74a834f9c8676d286b82906ab1220_NEAS.exe Flaseher.exe PID 2284 wrote to memory of 4676 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 4676 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 4676 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 4676 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 4676 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 4676 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 4676 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 4676 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe PID 2284 wrote to memory of 2396 2284 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ff74a834f9c8676d286b82906ab1220_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\2ff74a834f9c8676d286b82906ab1220_NEAS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2ff74a834f9c8676d286b82906ab1220_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\2ff74a834f9c8676d286b82906ab1220_NEAS.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SGTEC.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
PID:1556 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4676 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
PID:2396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
Filesize
130KB
MD50a4ef53703968984cda48729f6293ca8
SHA1f07658fa9c447acad7d87151fbea08ee04701389
SHA256d53584bbc9eeb9a54f02f614e61d3274683817becd0e1bc370e0e40a75914f12
SHA512961665e93d6c45586ea06a8b2fb63267c8255cec5fd5d054e9f616fa3dc8635ace5d716aaa8ca2ee1442a48f7045d3782a4b24acbe35776835701e7c65bd716f