Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2023, 08:34
Static task
static1
Behavioral task
behavioral1
Sample
DHL Shipping invoice _621407408,pdf.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
DHL Shipping invoice _621407408,pdf.exe
Resource
win10v2004-20230703-en
General
-
Target
DHL Shipping invoice _621407408,pdf.exe
-
Size
713KB
-
MD5
345c506c98f0db06efced50956ddc515
-
SHA1
96029a7540ece6f71b9fc016ff37b632f47099aa
-
SHA256
4152ea859c2de1e5aec3aab1d1172a22421c70f9a557a10ffbfc15f523555709
-
SHA512
d04ee5548b721e991a58515d4b18835c58f0a173e91adaf571eabc0520cbcc699a13218926d34b524d88511ee02733c4c963db9cac6d7f9dd27144ce43f6993c
-
SSDEEP
12288:3Ouy3CoGtRq54TIhnIvT7SEzI8h4COdzu2bbNYcqE:3lmGtRq5PI6EzI8BOdzu2bbNYcq
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Suspicious use of NtCreateProcessOtherParentProcess 1 IoCs
description pid Process PID 3952 created 0 3952 DHL Shipping invoice _621407408,pdf.exe -
ModiLoader Second Stage 62 IoCs
resource yara_rule behavioral2/memory/3952-210-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-254-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-255-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-256-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-257-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-258-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-259-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-260-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-261-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-262-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-263-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-264-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-265-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-266-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-267-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-268-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-269-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-270-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-271-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-272-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-273-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-274-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-275-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-276-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-277-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-278-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-279-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-280-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-281-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-282-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-284-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-283-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-285-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-286-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-287-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-288-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-289-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-290-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-291-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-292-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-293-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-294-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-295-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-296-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-297-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-298-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-299-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-300-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-301-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-302-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-303-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-304-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-305-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-306-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-307-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-308-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-309-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-310-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-311-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-312-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-313-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 behavioral2/memory/3952-314-0x00000000023A0000-0x00000000023D0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 4800 easinvoker.exe -
Loads dropped DLL 1 IoCs
pid Process 4800 easinvoker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ajkejgwi = "C:\\Users\\Public\\Ajkejgwi.url" DHL Shipping invoice _621407408,pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3952 set thread context of 4732 3952 DHL Shipping invoice _621407408,pdf.exe 105 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4880 PING.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 34 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 36 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3412 powershell.exe 3412 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3412 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4732 logagent.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3952 wrote to memory of 4824 3952 DHL Shipping invoice _621407408,pdf.exe 91 PID 3952 wrote to memory of 4824 3952 DHL Shipping invoice _621407408,pdf.exe 91 PID 3952 wrote to memory of 4824 3952 DHL Shipping invoice _621407408,pdf.exe 91 PID 4824 wrote to memory of 2036 4824 cmd.exe 93 PID 4824 wrote to memory of 2036 4824 cmd.exe 93 PID 4824 wrote to memory of 2036 4824 cmd.exe 93 PID 4824 wrote to memory of 4368 4824 cmd.exe 94 PID 4824 wrote to memory of 4368 4824 cmd.exe 94 PID 4824 wrote to memory of 4368 4824 cmd.exe 94 PID 4824 wrote to memory of 2824 4824 cmd.exe 95 PID 4824 wrote to memory of 2824 4824 cmd.exe 95 PID 4824 wrote to memory of 2824 4824 cmd.exe 95 PID 4824 wrote to memory of 776 4824 cmd.exe 96 PID 4824 wrote to memory of 776 4824 cmd.exe 96 PID 4824 wrote to memory of 776 4824 cmd.exe 96 PID 4824 wrote to memory of 5048 4824 cmd.exe 97 PID 4824 wrote to memory of 5048 4824 cmd.exe 97 PID 4824 wrote to memory of 5048 4824 cmd.exe 97 PID 4824 wrote to memory of 848 4824 cmd.exe 98 PID 4824 wrote to memory of 848 4824 cmd.exe 98 PID 4824 wrote to memory of 848 4824 cmd.exe 98 PID 4824 wrote to memory of 4800 4824 cmd.exe 99 PID 4824 wrote to memory of 4800 4824 cmd.exe 99 PID 4800 wrote to memory of 3452 4800 easinvoker.exe 100 PID 4800 wrote to memory of 3452 4800 easinvoker.exe 100 PID 4824 wrote to memory of 4880 4824 cmd.exe 102 PID 4824 wrote to memory of 4880 4824 cmd.exe 102 PID 4824 wrote to memory of 4880 4824 cmd.exe 102 PID 3452 wrote to memory of 3412 3452 cmd.exe 103 PID 3452 wrote to memory of 3412 3452 cmd.exe 103 PID 3952 wrote to memory of 4732 3952 DHL Shipping invoice _621407408,pdf.exe 105 PID 3952 wrote to memory of 4732 3952 DHL Shipping invoice _621407408,pdf.exe 105 PID 3952 wrote to memory of 4732 3952 DHL Shipping invoice _621407408,pdf.exe 105 PID 3952 wrote to memory of 4732 3952 DHL Shipping invoice _621407408,pdf.exe 105 PID 3952 wrote to memory of 4732 3952 DHL Shipping invoice _621407408,pdf.exe 105 PID 3952 wrote to memory of 4732 3952 DHL Shipping invoice _621407408,pdf.exe 105 PID 3952 wrote to memory of 4732 3952 DHL Shipping invoice _621407408,pdf.exe 105 PID 3952 wrote to memory of 4732 3952 DHL Shipping invoice _621407408,pdf.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipping invoice _621407408,pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipping invoice _621407408,pdf.exe"1⤵
- Suspicious use of NtCreateProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\AjkejgwiO.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"3⤵PID:2036
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y3⤵
- Enumerates system info in registry
PID:4368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"3⤵PID:2824
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y3⤵
- Enumerates system info in registry
PID:776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"3⤵PID:5048
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y3⤵
- Enumerates system info in registry
PID:848
-
-
C:\Windows \System32\easinvoker.exe"C:\Windows \System32\easinvoker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""4⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 63⤵
- Runs ping.exe
PID:4880
-
-
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:4732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
411B
MD555aba243e88f6a6813c117ffe1fa5979
SHA1210b9b028a4b798c837a182321dbf2e50d112816
SHA2565a11c5641c476891aa30e7ecfa57c2639f6827d8640061f73e9afec0adbbd7d2
SHA51268009c4c9bbea75a3bfa9f79945d30957a95691ea405d031b4ca7f1cb47504bbc768fcae59173885743ad4d6cfdd2313c3fe0acb515e34e5c809ecdc7f45e307
-
Filesize
155B
MD5213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
-
Filesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
Filesize
110KB
MD51623cdabd712eec8bdc1e462457b1c0b
SHA118dc92a97cd0b729fba6947675d7e004fc6931c2
SHA256365ad645e513c6d44825dc865895d54d62ded834aa2ff2b46e4f27a9d21e4c45
SHA512551fcea1d213eeb047a4c32a1de47bc1cada112759f3a496e1fa84d482ff05a3d9fa059efa578df99088f33a7b27449f19bb7c753a7da853b79d0f7edd85c36b
-
Filesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
Filesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
Filesize
110KB
MD51623cdabd712eec8bdc1e462457b1c0b
SHA118dc92a97cd0b729fba6947675d7e004fc6931c2
SHA256365ad645e513c6d44825dc865895d54d62ded834aa2ff2b46e4f27a9d21e4c45
SHA512551fcea1d213eeb047a4c32a1de47bc1cada112759f3a496e1fa84d482ff05a3d9fa059efa578df99088f33a7b27449f19bb7c753a7da853b79d0f7edd85c36b
-
Filesize
110KB
MD51623cdabd712eec8bdc1e462457b1c0b
SHA118dc92a97cd0b729fba6947675d7e004fc6931c2
SHA256365ad645e513c6d44825dc865895d54d62ded834aa2ff2b46e4f27a9d21e4c45
SHA512551fcea1d213eeb047a4c32a1de47bc1cada112759f3a496e1fa84d482ff05a3d9fa059efa578df99088f33a7b27449f19bb7c753a7da853b79d0f7edd85c36b
-
Filesize
155B
MD5213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7