Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 11:44
Behavioral task
behavioral1
Sample
Build.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Build.exe
Resource
win10v2004-20240419-en
General
-
Target
Build.exe
-
Size
18KB
-
MD5
189fafc8e1afe59d08a7969affc84ead
-
SHA1
cb5086ebd2cd8691407dd4565ece72a1c40b0a69
-
SHA256
0e8b0ea6f93217a3ec116d3a676ba901384061f2c59591d7126bfa260f7df955
-
SHA512
c96bea1295d5061512150e0ed0ff2501ced1f0046fa73e78ede158fb62820dfd1811c0dfdc380bce974a58d84adbe4b2339a9ea6841f4adee9bb4e5e36b95198
-
SSDEEP
384:QEw7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1CzcKM+6ene:QEw7wkHOYEGPvCaV4pLzb1f7+
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-11-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/2324-13-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
AdobeART.exepid process 2324 AdobeART.exe -
Loads dropped DLL 2 IoCs
Processes:
Build.exepid process 2084 Build.exe 2084 Build.exe -
Processes:
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x0000000000414000-memory.dmp upx \Users\Admin\AppData\Roaming\AdobeART.exe upx behavioral1/memory/2084-11-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2324-12-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2324-13-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Build.exedescription pid process target process PID 2084 wrote to memory of 2324 2084 Build.exe AdobeART.exe PID 2084 wrote to memory of 2324 2084 Build.exe AdobeART.exe PID 2084 wrote to memory of 2324 2084 Build.exe AdobeART.exe PID 2084 wrote to memory of 2324 2084 Build.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Build.exe"C:\Users\Admin\AppData\Local\Temp\Build.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5189fafc8e1afe59d08a7969affc84ead
SHA1cb5086ebd2cd8691407dd4565ece72a1c40b0a69
SHA2560e8b0ea6f93217a3ec116d3a676ba901384061f2c59591d7126bfa260f7df955
SHA512c96bea1295d5061512150e0ed0ff2501ced1f0046fa73e78ede158fb62820dfd1811c0dfdc380bce974a58d84adbe4b2339a9ea6841f4adee9bb4e5e36b95198