Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 23:27
Behavioral task
behavioral1
Sample
3084ceb40003c7d809456ccf45bd9b70_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3084ceb40003c7d809456ccf45bd9b70_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
3084ceb40003c7d809456ccf45bd9b70_NEAS.exe
-
Size
130KB
-
MD5
3084ceb40003c7d809456ccf45bd9b70
-
SHA1
372cb956d27aba4ac27217b19b2182a5d0fe578e
-
SHA256
e8f44e37d91f1200798cbc0cbad523e4271860be90f184b008002472fb6f491f
-
SHA512
a7d3cffeaf94c9b542fb47ddc6c4f293a8bcc8aaccb2545b9bf34983ac782518c35b5e1683d5987e33f36d173351b3679c6d41838e88d3a5a9cbacb27ea26fe7
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZI:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKi
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3304-50-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3304-53-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3304-54-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3304-58-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3304-59-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3084ceb40003c7d809456ccf45bd9b70_NEAS.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 1372 Flaseher.exe 1496 Flaseher.exe 3304 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/732-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3944-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3944-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/732-14-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3944-16-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/1372-40-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1372-43-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1372-44-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1372-49-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1372-57-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3944-60-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1496-62-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3084ceb40003c7d809456ccf45bd9b70_NEAS.exeFlaseher.exedescription pid process target process PID 732 set thread context of 3944 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe PID 1372 set thread context of 1496 1372 Flaseher.exe Flaseher.exe PID 1372 set thread context of 3304 1372 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe Token: SeDebugPrivilege 1496 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
3084ceb40003c7d809456ccf45bd9b70_NEAS.exe3084ceb40003c7d809456ccf45bd9b70_NEAS.exeFlaseher.exeFlaseher.exepid process 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3944 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 1372 Flaseher.exe 1496 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
3084ceb40003c7d809456ccf45bd9b70_NEAS.exe3084ceb40003c7d809456ccf45bd9b70_NEAS.execmd.exeFlaseher.exedescription pid process target process PID 732 wrote to memory of 3944 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe PID 732 wrote to memory of 3944 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe PID 732 wrote to memory of 3944 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe PID 732 wrote to memory of 3944 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe PID 732 wrote to memory of 3944 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe PID 732 wrote to memory of 3944 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe PID 732 wrote to memory of 3944 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe PID 732 wrote to memory of 3944 732 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe PID 3944 wrote to memory of 464 3944 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe cmd.exe PID 3944 wrote to memory of 464 3944 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe cmd.exe PID 3944 wrote to memory of 464 3944 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe cmd.exe PID 464 wrote to memory of 700 464 cmd.exe reg.exe PID 464 wrote to memory of 700 464 cmd.exe reg.exe PID 464 wrote to memory of 700 464 cmd.exe reg.exe PID 3944 wrote to memory of 1372 3944 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe Flaseher.exe PID 3944 wrote to memory of 1372 3944 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe Flaseher.exe PID 3944 wrote to memory of 1372 3944 3084ceb40003c7d809456ccf45bd9b70_NEAS.exe Flaseher.exe PID 1372 wrote to memory of 1496 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 1496 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 1496 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 1496 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 1496 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 1496 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 1496 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 1496 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe PID 1372 wrote to memory of 3304 1372 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3084ceb40003c7d809456ccf45bd9b70_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\3084ceb40003c7d809456ccf45bd9b70_NEAS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\3084ceb40003c7d809456ccf45bd9b70_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\3084ceb40003c7d809456ccf45bd9b70_NEAS.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ORCHM.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
PID:700 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1496 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
PID:3304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
Filesize
130KB
MD59f912f6ed0c0e324879c7c4e2d8f3da7
SHA1a9dbbcc4c3e9e6eb72396e0cf5a1379d8a2a79de
SHA2561fb7931f67b5bcac46f9c3cca9a558e71faa5c3301eff520f6762eccd834484f
SHA51251714462f61eb52ce009b40234e104bbe2ea0020e4cd18843bf96a39b482478fe8534fe2f5caa5153c366dfe45c6059624e7239e64cd2d36c07d303f6634dbff