Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2023, 08:34
Static task
static1
Behavioral task
behavioral1
Sample
DHL_2017128 Documento de recibo,pdf.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
DHL_2017128 Documento de recibo,pdf.exe
Resource
win10v2004-20230703-en
General
-
Target
DHL_2017128 Documento de recibo,pdf.exe
-
Size
713KB
-
MD5
33780c0b1e1e947eb65ed5a3edb607de
-
SHA1
3a8232371bb5f2225bda4478919b26c23e3d30cb
-
SHA256
ab09c0ffd7bc126ae2c18376baf5150284030c9b34211722aa3bddc7e7a09df7
-
SHA512
621b5e8abb990da5cfe0793ecb2a84ebf21416972bd7e2d46efdb2d602a019b792f0844a9bc481a88822d0a68c068a272485986b9d378cdda71b5cf8d5aedb96
-
SSDEEP
12288:3Ouy3CoGtRq54TIhnIvT7SEzI8h4COdzuCYcqE:3lmGtRq5PI6EzI8BOdzuCYcq
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Suspicious use of NtCreateProcessOtherParentProcess 1 IoCs
description pid Process PID 1616 created 0 1616 DHL_2017128 Documento de recibo,pdf.exe -
ModiLoader Second Stage 62 IoCs
resource yara_rule behavioral2/memory/1616-210-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-254-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-255-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-256-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-257-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-258-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-259-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-260-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-261-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-262-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-263-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-264-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-265-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-266-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-267-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-268-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-269-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-270-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-271-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-272-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-273-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-274-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-275-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-276-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-277-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-278-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-279-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-280-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-281-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-282-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-283-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-284-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-285-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-286-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-287-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-288-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-289-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-290-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-291-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-292-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-293-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-294-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-295-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-296-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-297-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-298-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-299-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-300-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-301-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-302-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-303-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-304-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-305-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-306-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-307-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-308-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-309-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-310-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-311-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-312-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-313-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 behavioral2/memory/1616-314-0x00000000022A0000-0x00000000022D0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 872 easinvoker.exe -
Loads dropped DLL 1 IoCs
pid Process 872 easinvoker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mvkxgdud = "C:\\Users\\Public\\Mvkxgdud.url" DHL_2017128 Documento de recibo,pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1616 set thread context of 936 1616 DHL_2017128 Documento de recibo,pdf.exe 106 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1324 PING.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 29 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 31 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3968 powershell.exe 3968 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3968 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 936 colorcpl.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1544 1616 DHL_2017128 Documento de recibo,pdf.exe 92 PID 1616 wrote to memory of 1544 1616 DHL_2017128 Documento de recibo,pdf.exe 92 PID 1616 wrote to memory of 1544 1616 DHL_2017128 Documento de recibo,pdf.exe 92 PID 1544 wrote to memory of 1868 1544 cmd.exe 94 PID 1544 wrote to memory of 1868 1544 cmd.exe 94 PID 1544 wrote to memory of 1868 1544 cmd.exe 94 PID 1544 wrote to memory of 3028 1544 cmd.exe 95 PID 1544 wrote to memory of 3028 1544 cmd.exe 95 PID 1544 wrote to memory of 3028 1544 cmd.exe 95 PID 1544 wrote to memory of 5104 1544 cmd.exe 96 PID 1544 wrote to memory of 5104 1544 cmd.exe 96 PID 1544 wrote to memory of 5104 1544 cmd.exe 96 PID 1544 wrote to memory of 4856 1544 cmd.exe 97 PID 1544 wrote to memory of 4856 1544 cmd.exe 97 PID 1544 wrote to memory of 4856 1544 cmd.exe 97 PID 1544 wrote to memory of 316 1544 cmd.exe 98 PID 1544 wrote to memory of 316 1544 cmd.exe 98 PID 1544 wrote to memory of 316 1544 cmd.exe 98 PID 1544 wrote to memory of 1524 1544 cmd.exe 99 PID 1544 wrote to memory of 1524 1544 cmd.exe 99 PID 1544 wrote to memory of 1524 1544 cmd.exe 99 PID 1544 wrote to memory of 872 1544 cmd.exe 100 PID 1544 wrote to memory of 872 1544 cmd.exe 100 PID 872 wrote to memory of 2996 872 easinvoker.exe 101 PID 872 wrote to memory of 2996 872 easinvoker.exe 101 PID 1544 wrote to memory of 1324 1544 cmd.exe 103 PID 1544 wrote to memory of 1324 1544 cmd.exe 103 PID 1544 wrote to memory of 1324 1544 cmd.exe 103 PID 2996 wrote to memory of 3968 2996 cmd.exe 104 PID 2996 wrote to memory of 3968 2996 cmd.exe 104 PID 1616 wrote to memory of 936 1616 DHL_2017128 Documento de recibo,pdf.exe 106 PID 1616 wrote to memory of 936 1616 DHL_2017128 Documento de recibo,pdf.exe 106 PID 1616 wrote to memory of 936 1616 DHL_2017128 Documento de recibo,pdf.exe 106 PID 1616 wrote to memory of 936 1616 DHL_2017128 Documento de recibo,pdf.exe 106 PID 1616 wrote to memory of 936 1616 DHL_2017128 Documento de recibo,pdf.exe 106 PID 1616 wrote to memory of 936 1616 DHL_2017128 Documento de recibo,pdf.exe 106 PID 1616 wrote to memory of 936 1616 DHL_2017128 Documento de recibo,pdf.exe 106 PID 1616 wrote to memory of 936 1616 DHL_2017128 Documento de recibo,pdf.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_2017128 Documento de recibo,pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_2017128 Documento de recibo,pdf.exe"1⤵
- Suspicious use of NtCreateProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\MvkxgdudO.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"3⤵PID:1868
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y3⤵
- Enumerates system info in registry
PID:3028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"3⤵PID:5104
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y3⤵
- Enumerates system info in registry
PID:4856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"3⤵PID:316
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y3⤵
- Enumerates system info in registry
PID:1524
-
-
C:\Windows \System32\easinvoker.exe"C:\Windows \System32\easinvoker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""4⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 63⤵
- Runs ping.exe
PID:1324
-
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
155B
MD5213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
-
Filesize
411B
MD555aba243e88f6a6813c117ffe1fa5979
SHA1210b9b028a4b798c837a182321dbf2e50d112816
SHA2565a11c5641c476891aa30e7ecfa57c2639f6827d8640061f73e9afec0adbbd7d2
SHA51268009c4c9bbea75a3bfa9f79945d30957a95691ea405d031b4ca7f1cb47504bbc768fcae59173885743ad4d6cfdd2313c3fe0acb515e34e5c809ecdc7f45e307
-
Filesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
Filesize
110KB
MD51623cdabd712eec8bdc1e462457b1c0b
SHA118dc92a97cd0b729fba6947675d7e004fc6931c2
SHA256365ad645e513c6d44825dc865895d54d62ded834aa2ff2b46e4f27a9d21e4c45
SHA512551fcea1d213eeb047a4c32a1de47bc1cada112759f3a496e1fa84d482ff05a3d9fa059efa578df99088f33a7b27449f19bb7c753a7da853b79d0f7edd85c36b
-
Filesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
Filesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
Filesize
110KB
MD51623cdabd712eec8bdc1e462457b1c0b
SHA118dc92a97cd0b729fba6947675d7e004fc6931c2
SHA256365ad645e513c6d44825dc865895d54d62ded834aa2ff2b46e4f27a9d21e4c45
SHA512551fcea1d213eeb047a4c32a1de47bc1cada112759f3a496e1fa84d482ff05a3d9fa059efa578df99088f33a7b27449f19bb7c753a7da853b79d0f7edd85c36b
-
Filesize
110KB
MD51623cdabd712eec8bdc1e462457b1c0b
SHA118dc92a97cd0b729fba6947675d7e004fc6931c2
SHA256365ad645e513c6d44825dc865895d54d62ded834aa2ff2b46e4f27a9d21e4c45
SHA512551fcea1d213eeb047a4c32a1de47bc1cada112759f3a496e1fa84d482ff05a3d9fa059efa578df99088f33a7b27449f19bb7c753a7da853b79d0f7edd85c36b
-
Filesize
155B
MD5213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7