Analysis
-
max time kernel
299s -
max time network
295s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 02:14
General
-
Target
19561b33793dcb865eae56575a899ce8_kovter_from_Sakura82_taskmanger.exe
-
Size
119KB
-
MD5
19561b33793dcb865eae56575a899ce8
-
SHA1
aeff444147fb35adbdf4faed6b5c4bd385b1d98c
-
SHA256
d625fcec98e282032f550ba80f60de2603adc9f18dd6ae597defda9df5200bd2
-
SHA512
c1ddaafcd3b8623f446acec01afe763e765e3abf930fe258e6cb728f6c2f68c1cf3c966f12473267628c4d8613b74c68c5369e03a5bbbc3c9db4c0584da0fad1
-
SSDEEP
3072:TphxjSC0KVR9sr6NuO4pTMq5tWkLgQ3+jOJgg3gv/5f6XKk6+/F:Tp7jYKV8+Nhud5dLgDyggE5sKo
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modiloader family
-
ModiLoader Second Stage 24 IoCs
-
Adds policy Run key to start application 2 TTPs 4 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 32 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19561b33793dcb865eae56575a899ce8_kovter_from_Sakura82_taskmanger.exe"C:\Users\Admin\AppData\Local\Temp\19561b33793dcb865eae56575a899ce8_kovter_from_Sakura82_taskmanger.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exepath<<C:\Users\Admin\AppData\Local\Temp\19561b33793dcb865eae56575a899ce8_kovter_from_Sakura82_taskmanger.exe>>path2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Deletes itself
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD524c86959186c21d525f80fe4e0bc4b6a
SHA157f20ad834745bb54242b27cc71d3e015c2e0879
SHA25636def945b7060f4bc287595468790c8eba36eb506b7b9bb2d53d6bc0eb248172
SHA512c40c7f626522f7c836a033fb9b6bd200bd0bc14c1546ac9649d4e7a2f8e96d72703c3f22f19f8656bb05df1e7b72b95a74355ec46f8a734cbd52c8511ad8bf06
-
Filesize
342B
MD512868648da207468a927bedddcb972cd
SHA166d192a92a8486e6d074c6fddd26efef5fcf88e4
SHA25682abfd6e10c0d6f729607c574ecf98d2783dbfa953c22d4a99e41671695a3cbb
SHA51267baa4128ecbdfe9d9fb7578b26d9e0c1952b317e810035110224209907f3cf10fdc6dda9e1c288b3388313d65fda7b1e4c2639ffdccdf6b5320838391fcdc07
-
Filesize
119KB
MD519561b33793dcb865eae56575a899ce8
SHA1aeff444147fb35adbdf4faed6b5c4bd385b1d98c
SHA256d625fcec98e282032f550ba80f60de2603adc9f18dd6ae597defda9df5200bd2
SHA512c1ddaafcd3b8623f446acec01afe763e765e3abf930fe258e6cb728f6c2f68c1cf3c966f12473267628c4d8613b74c68c5369e03a5bbbc3c9db4c0584da0fad1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
76KB
-
Filesize
24KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
76KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB