Analysis
-
max time kernel
134s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 05:26
Behavioral task
behavioral1
Sample
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe
Resource
win10v2004-20240426-en
General
-
Target
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe
-
Size
43KB
-
MD5
73192906b5554291d79b9602e6f07321
-
SHA1
ac7322f341fbd6765384656dea3bbdcf8a398811
-
SHA256
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4
-
SHA512
9f9d518de351c23fff6c6404a96965d2cd7ef948a5d357206df427b865d142e552f09add863ea3acea65b6eed96473a2f1cb612e503648af4b89a305c762a75b
-
SSDEEP
768:XxXExy1Acg8udRyVYEC7MPWUANyEgAH0t4o1u7SXjxq11jF+Sh:XZ5Acg1Rn7MPWTzrHmVrm1w4
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/828-14-0x0000000000400000-0x000000000040A000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe -
Executes dropped EXE 1 IoCs
Processes:
ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exepid process 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exepid process 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exeÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exedescription pid process target process PID 828 wrote to memory of 4056 828 edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe PID 828 wrote to memory of 4056 828 edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe PID 828 wrote to memory of 4056 828 edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe PID 4056 wrote to memory of 3424 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe Explorer.EXE PID 4056 wrote to memory of 3424 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe Explorer.EXE PID 4056 wrote to memory of 3424 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe Explorer.EXE PID 4056 wrote to memory of 3424 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe Explorer.EXE PID 4056 wrote to memory of 3424 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe Explorer.EXE PID 4056 wrote to memory of 3424 4056 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe"C:\Users\Admin\AppData\Local\Temp\edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe"C:\Users\Admin\AppData\Local\Temp\ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exeFilesize
28KB
MD5100b2759aac1adc7f4ddbb2476453943
SHA1f462185fa4b97b821f51b031fd16ad1855bdbfe9
SHA256fb03a8557b3efe097d9db4262014b2704c323859a6c15d6ce6731c84e03a7833
SHA512920b0149e65aaa91911a2685b2d2c069c6388d91c1b0cfc9da7534547d25863b8fc0404e927401b6a3516af8cdc578c7fdc248c6e2f05a3bb4f841d5e265f73e
-
memory/828-14-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3424-15-0x000000007FFF0000-0x000000007FFF1000-memory.dmpFilesize
4KB
-
memory/3424-18-0x000000007FFC0000-0x000000007FFC7000-memory.dmpFilesize
28KB
-
memory/4056-13-0x0000000000400000-0x00000000004083A0-memory.dmpFilesize
32KB
-
memory/4056-16-0x0000000010000000-0x0000000010011000-memory.dmpFilesize
68KB