Overview
overview
10Static
static
1008e454a691...23.zip
windows7-x64
108e454a691...23.zip
windows10-2004-x64
1Client.exe
windows7-x64
10Client.exe
windows10-2004-x64
10Editor.exe
windows7-x64
10Editor.exe
windows10-2004-x64
10OptixPRO T...an.pdf
windows7-x64
1OptixPRO T...an.pdf
windows10-2004-x64
1Server.exe
windows7-x64
10Server.exe
windows10-2004-x64
10README.vbs
windows7-x64
1README.vbs
windows10-2004-x64
1setup.ps1
windows7-x64
1setup.ps1
windows10-2004-x64
1subseven.ps1
windows7-x64
1subseven.ps1
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2023 17:39
Behavioral task
behavioral1
Sample
08e454a691a4836663a117c9c43f6323.zip
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
08e454a691a4836663a117c9c43f6323.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Client.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
Client.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Editor.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
Editor.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
OptixPRO Tutorial german.pdf
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
OptixPRO Tutorial german.pdf
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Server.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
Server.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
README.vbs
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
README.vbs
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
setup.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
setup.ps1
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
subseven.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
subseven.ps1
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
Server.exe
-
Size
871KB
-
MD5
384104967fb35e3d459552f8bc104fae
-
SHA1
97b85538978d75502744012a6b5f1023f09d4ed1
-
SHA256
a1b29d36cf876f7ef48d3902ca60f5f444c30bee0515e15bbc8ac04fedc3978e
-
SHA512
8d16e3698e6baad4bfa4b048a564729e7ec5efc35dc1e7079466a8c811efb00015da43ad3b02d8a87d0a1fc4dc6bf3a54081ec422761517dada52211918c11e5
-
SSDEEP
12288:OCnrin3t/UCdwfTnbJO1DMopqQMUsS39d9kRDuwKqS4NroyV3x6rFWlERpML0b:Nnrind/U4vqQ+S39daRDuUSUh6S6pMLa
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 7 IoCs
resource yara_rule behavioral10/files/0x0006000000023222-3.dat modiloader_stage2 behavioral10/memory/2904-6-0x0000000000400000-0x00000000004DF000-memory.dmp modiloader_stage2 behavioral10/memory/928-7-0x0000000000400000-0x00000000004DF000-memory.dmp modiloader_stage2 behavioral10/memory/928-11-0x0000000000400000-0x00000000004DF000-memory.dmp modiloader_stage2 behavioral10/memory/928-14-0x0000000000400000-0x00000000004DF000-memory.dmp modiloader_stage2 behavioral10/memory/928-17-0x0000000000400000-0x00000000004DF000-memory.dmp modiloader_stage2 behavioral10/memory/928-20-0x0000000000400000-0x00000000004DF000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 928 spooll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vscanner = "c:\\windows\\spooll32.exe" Server.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created \??\c:\windows\spooll32.exe Server.exe File opened for modification \??\c:\windows\spooll32.exe Server.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2904 Server.exe 2904 Server.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe 928 spooll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2904 Server.exe Token: SeDebugPrivilege 2904 Server.exe Token: SeDebugPrivilege 928 spooll32.exe Token: SeDebugPrivilege 928 spooll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2904 wrote to memory of 928 2904 Server.exe 90 PID 2904 wrote to memory of 928 2904 Server.exe 90 PID 2904 wrote to memory of 928 2904 Server.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\windows\spooll32.exec:\windows\spooll32.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
871KB
MD5384104967fb35e3d459552f8bc104fae
SHA197b85538978d75502744012a6b5f1023f09d4ed1
SHA256a1b29d36cf876f7ef48d3902ca60f5f444c30bee0515e15bbc8ac04fedc3978e
SHA5128d16e3698e6baad4bfa4b048a564729e7ec5efc35dc1e7079466a8c811efb00015da43ad3b02d8a87d0a1fc4dc6bf3a54081ec422761517dada52211918c11e5