Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-10-2024 09:11
General
-
Target
48974dd06ef7e2587826fb6d0e4fe7b0.exe
-
Size
352KB
-
MD5
48974dd06ef7e2587826fb6d0e4fe7b0
-
SHA1
574a56950ab7f860b9a34238058bdd57958222db
-
SHA256
5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268
-
SHA512
9672cc8820a63489992200778a2cdb5f73afc344db0462efbba1b592bdc042a6e7e50cf837faa283c3186dcf2d5656a5c7b067294db28dcf302981714cd7a992
-
SSDEEP
6144:e8ubWcC2hsfVfLg5+fTFZH/IWCvHRfdh8tkS8R9SqtJCAxAYUSEy9AfC0v:etSIhsRLE+fTFZgnvxfdh8tnDs0wAfSO
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
-
ModiLoader Second Stage 62 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\48974dd06ef7e2587826fb6d0e4fe7b0.exe"C:\Users\Admin\AppData\Local\Temp\48974dd06ef7e2587826fb6d0e4fe7b0.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:Vl2Qu="SEtv";Ve1=new%20ActiveXObject("WScript.Shell");RbLFqEB7="2AFswhz";YI9z6s=Ve1.RegRead("HKCU\\software\\GFnQYgIj0\\uqpo2NGwQ");a4L0Eo="0NELy";eval(YI9z6s);mDmz7U="Q8W0j1n";1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:qptczdwt2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD54ac4847085019eda5dba9e702e182a95
SHA1cd3956178f162bcfdf3955eebf59499e9801f288
SHA256c54f57c245861f133743d1f6c3fc886503fccc8870ae9980e3ba966d7de9589e
SHA5121a5fe66640a0cb3cec2efd228948e87dabb321a839a3f3208cacd554ed9b7ef788e115373c54caabdaf9a452ee2059fec286af95f5dd438aa899405dd3d7f608
-
Filesize
15KB
MD52cf89aa609fb50fd4fefb656f4803b33
SHA100b0cba1b2f67a42db4f5b33ce434c4a31b63a01
SHA25641e2742f99d2b89cc4af8666c1e4c0c540f8d65bcfcc8fb6a21a96ce5a6aac93
SHA51291fdcb41e22feed8567c8e5b418d6eee5545613baabe23dac08f55eb1b9acbaec39b9cf4cb631b391a46a2bf412569191ce248db4322f35e778c7b8a1e93b296
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
880KB
-
Filesize
391KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
391KB
-
Filesize
8KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB