Analysis
- max time kernel
92s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
03/02/2024, 11:24
Behavioral task
behavioral1
Sample
8c33e529ddf1e4a91544548a66462e3c.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c33e529ddf1e4a91544548a66462e3c.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 8c33e529ddf1e4a91544548a66462e3c.exe
- Size 275KB
- Sample240203-nhtwjsfgf7
- SHA256 4a08c2a01b0a1ada4459caa1c7e5f13e0180d3e346f822c1b768b60e3702f9b4
- MD5 8c33e529ddf1e4a91544548a66462e3c
- SHA1 d20297d3096e62703a48c2ef04baf92ca111d16d
- SHA512 37a55bd96d5fb47b6613ec29059468e40ea6782cb3c19fee2c2e470f1f1c7d4b71da8f1f486aa932fb869399c30bf7be9f306769a7bac46eb88694fc0c0663d7
- SSDEEP 6144:+lXb4JDQoNSWiwassZFbuPZYHNv/5rH4+af2rJpT/YSnNBzp:0b4J/sqascFQqtv/V4NfkJpT/L
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\System32\\userinit.exe,\"C:\\Users\\Admin\\Favorites\\netservice.exe\"un userinit.exe" 8c33e529ddf1e4a91544548a66462e3c.exe - ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/1684-0-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/1684-8-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 -
resource yara_rule behavioral2/memory/1684-5-0x0000000010410000-0x0000000010494000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1684 8c33e529ddf1e4a91544548a66462e3c.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87 PID 1684 wrote to memory of 3260 1684 8c33e529ddf1e4a91544548a66462e3c.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c33e529ddf1e4a91544548a66462e3c.exe"C:\Users\Admin\AppData\Local\Temp\8c33e529ddf1e4a91544548a66462e3c.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" about:blank2⤵PID:3260
-