Analysis
-
max time kernel
143s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 21:47
General
-
Target
19561b33793dcb865eae56575a899ce8_kovter_from_Sakura82_taskmanger.exe
-
Size
119KB
-
MD5
19561b33793dcb865eae56575a899ce8
-
SHA1
aeff444147fb35adbdf4faed6b5c4bd385b1d98c
-
SHA256
d625fcec98e282032f550ba80f60de2603adc9f18dd6ae597defda9df5200bd2
-
SHA512
c1ddaafcd3b8623f446acec01afe763e765e3abf930fe258e6cb728f6c2f68c1cf3c966f12473267628c4d8613b74c68c5369e03a5bbbc3c9db4c0584da0fad1
-
SSDEEP
3072:TphxjSC0KVR9sr6NuO4pTMq5tWkLgQ3+jOJgg3gv/5f6XKk6+/F:Tp7jYKV8+Nhud5dLgDyggE5sKo
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modiloader family
-
ModiLoader Second Stage 18 IoCs
-
Adds policy Run key to start application 2 TTPs 4 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19561b33793dcb865eae56575a899ce8_kovter_from_Sakura82_taskmanger.exe"C:\Users\Admin\AppData\Local\Temp\19561b33793dcb865eae56575a899ce8_kovter_from_Sakura82_taskmanger.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exepath<<C:\Users\Admin\AppData\Local\Temp\19561b33793dcb865eae56575a899ce8_kovter_from_Sakura82_taskmanger.exe>>path2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Deletes itself
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD519561b33793dcb865eae56575a899ce8
SHA1aeff444147fb35adbdf4faed6b5c4bd385b1d98c
SHA256d625fcec98e282032f550ba80f60de2603adc9f18dd6ae597defda9df5200bd2
SHA512c1ddaafcd3b8623f446acec01afe763e765e3abf930fe258e6cb728f6c2f68c1cf3c966f12473267628c4d8613b74c68c5369e03a5bbbc3c9db4c0584da0fad1
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
24KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB