Analysis
-
max time kernel
52s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 08:01
Behavioral task
behavioral1
Sample
NewX.exe
Resource
win10v2004-20240508-en
General
-
Target
NewX.exe
-
Size
18KB
-
MD5
04e8a7b1a3a658cb5d8041542195075a
-
SHA1
22bf6e551c2c0279d2d0bc41a68f378c71b2d8f0
-
SHA256
0288572315915db261182f65784eb05ffdc4edb9774c88f68b085362dfad19b3
-
SHA512
4082e953b0dc9be718283c0cb295bb218d1df5f15712f7a488f426f8b8e24ee1a2b67b30d80e52eba3bc5116b04589113c655ee92f4da73039dec325cbe13d0f
-
SSDEEP
384:jEw7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1CzcNlqAne:jEw7wkHOYEGPvCaV4pLzb1fNl
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4548-9-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/3912-11-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NewX.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation NewX.exe -
Executes dropped EXE 1 IoCs
Processes:
ducservice.exepid process 3912 ducservice.exe -
Processes:
resource yara_rule behavioral1/memory/4548-0-0x0000000000400000-0x0000000000414000-memory.dmp upx C:\Users\Admin\AppData\Roaming\ducservice.exe upx behavioral1/memory/3912-8-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/4548-9-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/3912-11-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ducservice.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ducservice = "C:\\Users\\Admin\\AppData\\Roaming\\ducservice.exe" ducservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
NewX.exedescription pid process target process PID 4548 wrote to memory of 3912 4548 NewX.exe ducservice.exe PID 4548 wrote to memory of 3912 4548 NewX.exe ducservice.exe PID 4548 wrote to memory of 3912 4548 NewX.exe ducservice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewX.exe"C:\Users\Admin\AppData\Local\Temp\NewX.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ducservice.exe"C:\Users\Admin\AppData\Roaming\ducservice.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ducservice.exeFilesize
18KB
MD504e8a7b1a3a658cb5d8041542195075a
SHA122bf6e551c2c0279d2d0bc41a68f378c71b2d8f0
SHA2560288572315915db261182f65784eb05ffdc4edb9774c88f68b085362dfad19b3
SHA5124082e953b0dc9be718283c0cb295bb218d1df5f15712f7a488f426f8b8e24ee1a2b67b30d80e52eba3bc5116b04589113c655ee92f4da73039dec325cbe13d0f
-
memory/3912-8-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3912-11-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4548-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4548-9-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB