Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 11:44
Behavioral task
behavioral1
Sample
Build.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Build.exe
Resource
win10v2004-20240419-en
General
-
Target
Build.exe
-
Size
18KB
-
MD5
189fafc8e1afe59d08a7969affc84ead
-
SHA1
cb5086ebd2cd8691407dd4565ece72a1c40b0a69
-
SHA256
0e8b0ea6f93217a3ec116d3a676ba901384061f2c59591d7126bfa260f7df955
-
SHA512
c96bea1295d5061512150e0ed0ff2501ced1f0046fa73e78ede158fb62820dfd1811c0dfdc380bce974a58d84adbe4b2339a9ea6841f4adee9bb4e5e36b95198
-
SSDEEP
384:QEw7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1CzcKM+6ene:QEw7wkHOYEGPvCaV4pLzb1f7+
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4256-8-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/508-11-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Build.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation Build.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeART.exepid process 508 AdobeART.exe -
Processes:
resource yara_rule behavioral2/memory/4256-0-0x0000000000400000-0x0000000000414000-memory.dmp upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx behavioral2/memory/4256-8-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/508-10-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/508-11-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Build.exedescription pid process target process PID 4256 wrote to memory of 508 4256 Build.exe AdobeART.exe PID 4256 wrote to memory of 508 4256 Build.exe AdobeART.exe PID 4256 wrote to memory of 508 4256 Build.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Build.exe"C:\Users\Admin\AppData\Local\Temp\Build.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5189fafc8e1afe59d08a7969affc84ead
SHA1cb5086ebd2cd8691407dd4565ece72a1c40b0a69
SHA2560e8b0ea6f93217a3ec116d3a676ba901384061f2c59591d7126bfa260f7df955
SHA512c96bea1295d5061512150e0ed0ff2501ced1f0046fa73e78ede158fb62820dfd1811c0dfdc380bce974a58d84adbe4b2339a9ea6841f4adee9bb4e5e36b95198