Analysis
- max time kernel
140s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
30/01/2024, 10:43
General
- Target 823b312f5750414c3d39fed13bc75c58.exe
- Size 631KB
- Sample240130-msjynaecg3
- SHA256 3f0ec7c1395ae852820a88e0ed5b7d8efcc547f547f078450e20bc8b63db854f
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 3 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\823b312f5750414c3d39fed13bc75c58.exe"C:\Users\Admin\AppData\Local\Temp\823b312f5750414c3d39fed13bc75c58.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\a1g.exeC:\Windows\a1g.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 6643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\DelSvel.bat2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 212 -ip 2121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DelSvel.bat
a1g.exe
memory/212-53-0x0000000002120000-0x0000000002174000-memory.dmp
memory/212-52-0x0000000000400000-0x0000000000522000-memory.dmp
memory/212-51-0x0000000003450000-0x0000000003451000-memory.dmp
memory/212-38-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/212-42-0x00000000025F0000-0x00000000025F1000-memory.dmp
memory/212-39-0x0000000003410000-0x0000000003411000-memory.dmp
memory/212-40-0x0000000003400000-0x0000000003401000-memory.dmp
memory/212-41-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/212-35-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/212-34-0x0000000002120000-0x0000000002174000-memory.dmp
memory/1312-29-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/1312-30-0x0000000002730000-0x0000000002731000-memory.dmp
memory/1312-24-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/1312-23-0x0000000003610000-0x0000000003611000-memory.dmp
memory/1312-22-0x0000000003510000-0x0000000003513000-memory.dmp
memory/1312-20-0x0000000002540000-0x0000000002541000-memory.dmp
memory/1312-21-0x0000000003520000-0x0000000003521000-memory.dmp
memory/1312-26-0x0000000003550000-0x0000000003551000-memory.dmp
memory/1312-5-0x0000000002530000-0x0000000002531000-memory.dmp
memory/1312-2-0x0000000002570000-0x0000000002571000-memory.dmp
memory/1312-27-0x0000000003540000-0x0000000003541000-memory.dmp
memory/1312-28-0x0000000003530000-0x0000000003531000-memory.dmp
memory/1312-0-0x0000000000400000-0x0000000000522000-memory.dmp
memory/1312-25-0x0000000000800000-0x0000000000801000-memory.dmp
memory/1312-8-0x0000000002580000-0x0000000002581000-memory.dmp
memory/1312-9-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/1312-7-0x0000000002590000-0x0000000002591000-memory.dmp
memory/1312-46-0x0000000000400000-0x0000000000522000-memory.dmp
memory/1312-48-0x0000000002340000-0x0000000002394000-memory.dmp
memory/1312-49-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1312-6-0x0000000002520000-0x0000000002521000-memory.dmp
memory/1312-47-0x0000000003590000-0x0000000003591000-memory.dmp
memory/1312-4-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/1312-3-0x0000000002550000-0x0000000002551000-memory.dmp
memory/1312-1-0x0000000002340000-0x0000000002394000-memory.dmp