Analysis

  • max time kernel
    146s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2023, 08:34

General

  • Target

    DHL_2017128 Documento de recibo,pdf.exe

  • Size

    713KB

  • MD5

    33780c0b1e1e947eb65ed5a3edb607de

  • SHA1

    3a8232371bb5f2225bda4478919b26c23e3d30cb

  • SHA256

    ab09c0ffd7bc126ae2c18376baf5150284030c9b34211722aa3bddc7e7a09df7

  • SHA512

    621b5e8abb990da5cfe0793ecb2a84ebf21416972bd7e2d46efdb2d602a019b792f0844a9bc481a88822d0a68c068a272485986b9d378cdda71b5cf8d5aedb96

  • SSDEEP

    12288:3Ouy3CoGtRq54TIhnIvT7SEzI8h4COdzuCYcqE:3lmGtRq5PI6EzI8BOdzuCYcq

Malware Config

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Suspicious use of NtCreateProcessOtherParentProcess 1 IoCs
  • ModiLoader Second Stage 62 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL_2017128 Documento de recibo,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL_2017128 Documento de recibo,pdf.exe"
    1⤵
    • Suspicious use of NtCreateProcessOtherParentProcess
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\MvkxgdudO.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        3⤵
          PID:1868
        • C:\Windows\SysWOW64\xcopy.exe
          xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y
          3⤵
          • Enumerates system info in registry
          PID:3028
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
          3⤵
            PID:5104
          • C:\Windows\SysWOW64\xcopy.exe
            xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y
            3⤵
            • Enumerates system info in registry
            PID:4856
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
            3⤵
              PID:316
            • C:\Windows\SysWOW64\xcopy.exe
              xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y
              3⤵
              • Enumerates system info in registry
              PID:1524
            • C:\Windows \System32\easinvoker.exe
              "C:\Windows \System32\easinvoker.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:872
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2996
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3968
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 6
              3⤵
              • Runs ping.exe
              PID:1324
          • C:\Windows\SysWOW64\colorcpl.exe
            C:\Windows\System32\colorcpl.exe
            2⤵
            • Suspicious use of SetWindowsHookEx
            PID:936

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4e5qocuc.hz5.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Public\Libraries\KDECO.bat

          Filesize

          155B

          MD5

          213c60adf1c9ef88dc3c9b2d579959d2

          SHA1

          e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021

          SHA256

          37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e

          SHA512

          fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7

        • C:\Users\Public\Libraries\MvkxgdudO.bat

          Filesize

          411B

          MD5

          55aba243e88f6a6813c117ffe1fa5979

          SHA1

          210b9b028a4b798c837a182321dbf2e50d112816

          SHA256

          5a11c5641c476891aa30e7ecfa57c2639f6827d8640061f73e9afec0adbbd7d2

          SHA512

          68009c4c9bbea75a3bfa9f79945d30957a95691ea405d031b4ca7f1cb47504bbc768fcae59173885743ad4d6cfdd2313c3fe0acb515e34e5c809ecdc7f45e307

        • C:\Users\Public\Libraries\easinvoker.exe

          Filesize

          128KB

          MD5

          231ce1e1d7d98b44371ffff407d68b59

          SHA1

          25510d0f6353dbf0c9f72fc880de7585e34b28ff

          SHA256

          30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

          SHA512

          520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

        • C:\Users\Public\Libraries\netutils.dll

          Filesize

          110KB

          MD5

          1623cdabd712eec8bdc1e462457b1c0b

          SHA1

          18dc92a97cd0b729fba6947675d7e004fc6931c2

          SHA256

          365ad645e513c6d44825dc865895d54d62ded834aa2ff2b46e4f27a9d21e4c45

          SHA512

          551fcea1d213eeb047a4c32a1de47bc1cada112759f3a496e1fa84d482ff05a3d9fa059efa578df99088f33a7b27449f19bb7c753a7da853b79d0f7edd85c36b

        • C:\Windows \System32\easinvoker.exe

          Filesize

          128KB

          MD5

          231ce1e1d7d98b44371ffff407d68b59

          SHA1

          25510d0f6353dbf0c9f72fc880de7585e34b28ff

          SHA256

          30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

          SHA512

          520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

        • C:\Windows \System32\easinvoker.exe

          Filesize

          128KB

          MD5

          231ce1e1d7d98b44371ffff407d68b59

          SHA1

          25510d0f6353dbf0c9f72fc880de7585e34b28ff

          SHA256

          30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

          SHA512

          520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

        • C:\Windows \System32\netutils.dll

          Filesize

          110KB

          MD5

          1623cdabd712eec8bdc1e462457b1c0b

          SHA1

          18dc92a97cd0b729fba6947675d7e004fc6931c2

          SHA256

          365ad645e513c6d44825dc865895d54d62ded834aa2ff2b46e4f27a9d21e4c45

          SHA512

          551fcea1d213eeb047a4c32a1de47bc1cada112759f3a496e1fa84d482ff05a3d9fa059efa578df99088f33a7b27449f19bb7c753a7da853b79d0f7edd85c36b

        • C:\Windows \System32\netutils.dll

          Filesize

          110KB

          MD5

          1623cdabd712eec8bdc1e462457b1c0b

          SHA1

          18dc92a97cd0b729fba6947675d7e004fc6931c2

          SHA256

          365ad645e513c6d44825dc865895d54d62ded834aa2ff2b46e4f27a9d21e4c45

          SHA512

          551fcea1d213eeb047a4c32a1de47bc1cada112759f3a496e1fa84d482ff05a3d9fa059efa578df99088f33a7b27449f19bb7c753a7da853b79d0f7edd85c36b

        • C:\windows \system32\KDECO.bat

          Filesize

          155B

          MD5

          213c60adf1c9ef88dc3c9b2d579959d2

          SHA1

          e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021

          SHA256

          37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e

          SHA512

          fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7

        • memory/936-566-0x0000000000400000-0x0000000000477000-memory.dmp

          Filesize

          476KB

        • memory/936-506-0x0000000000400000-0x0000000000477000-memory.dmp

          Filesize

          476KB

        • memory/1616-285-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-292-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-259-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-260-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-261-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-262-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-263-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-264-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-265-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-266-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-267-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-268-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-269-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-270-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-271-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-272-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-273-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-274-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-275-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-276-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-277-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-278-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-279-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-280-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-281-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-282-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-283-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-284-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-257-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-286-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-287-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-288-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-289-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-290-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-291-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-258-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-293-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-294-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-295-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-296-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-297-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-298-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-299-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-300-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-301-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-302-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-303-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-304-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-305-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-306-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-307-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-308-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-309-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-256-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-255-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-254-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-253-0x0000000002270000-0x0000000002271000-memory.dmp

          Filesize

          4KB

        • memory/1616-310-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-311-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-312-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-313-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-314-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/1616-133-0x0000000002270000-0x0000000002271000-memory.dmp

          Filesize

          4KB

        • memory/1616-252-0x0000000000400000-0x00000000004B9000-memory.dmp

          Filesize

          740KB

        • memory/1616-210-0x00000000022A0000-0x00000000022D0000-memory.dmp

          Filesize

          192KB

        • memory/3968-448-0x000001F64B470000-0x000001F64B480000-memory.dmp

          Filesize

          64KB

        • memory/3968-450-0x000001F64B470000-0x000001F64B480000-memory.dmp

          Filesize

          64KB

        • memory/3968-449-0x000001F64B470000-0x000001F64B480000-memory.dmp

          Filesize

          64KB

        • memory/3968-453-0x00007FFC894F0000-0x00007FFC89FB1000-memory.dmp

          Filesize

          10.8MB

        • memory/3968-447-0x00007FFC894F0000-0x00007FFC89FB1000-memory.dmp

          Filesize

          10.8MB

        • memory/3968-437-0x000001F633050000-0x000001F633072000-memory.dmp

          Filesize

          136KB