Analysis
-
max time kernel
89s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
8ca5f1fa2d996a25c0d7d46e8a0725a2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8ca5f1fa2d996a25c0d7d46e8a0725a2.exe
Resource
win10v2004-20231222-en
General
-
Target
8ca5f1fa2d996a25c0d7d46e8a0725a2.exe
-
Size
912KB
-
MD5
8ca5f1fa2d996a25c0d7d46e8a0725a2
-
SHA1
bef0493452f8830663321cc19d6f98f01f27c152
-
SHA256
547b319609a15ad9aa358122f6730843ae541d6dc6b6c3ecc0135767664bf865
-
SHA512
7a03715caa48029ec35dd283652c12a94a5a97d1aa14a949c8ea40334feea569aaf1fb8b9ac4e5e7a8d62b08a53025967354ebc365308597ef8bfa8f7287eb5f
-
SSDEEP
24576:kqfoqT3CO1cjxZMXBrwuZUy5DPZWN+HuMSV653RGn0uEitV:kILCCcjxZ8fOy5DAN+OMSc8BdH
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/1272-64-0x0000000000400000-0x0000000001688000-memory.dmp modiloader_stage2 behavioral2/memory/4360-66-0x0000000000400000-0x0000000001688000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 1272 RECYCLER.EXE -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\N: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\O: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\P: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\U: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\Y: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\E: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\M: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\Q: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\R: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\V: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\X: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\G: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\J: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\Z: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\B: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\H: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\I: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\K: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\S: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\T: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\W: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened (read-only) \??\A: 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\AutoRun.inf 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened for modification F:\AutoRun.inf 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1272 set thread context of 4092 1272 RECYCLER.EXE 94 -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\_RECYCLER.EXE RECYCLER.EXE File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\RECYCLER.EXE 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\RECYCLER.EXE 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe File created C:\Program Files\_RECYCLER.EXE RECYCLER.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31086259" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1801833551" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{96DAE147-C2A6-11EE-A0B6-F2334ED3B5DD} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31086259" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1801833551" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086259" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1802927656" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413738099" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1802927656" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086259" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4092 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4092 IEXPLORE.EXE 4092 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4360 wrote to memory of 1272 4360 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe 91 PID 4360 wrote to memory of 1272 4360 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe 91 PID 4360 wrote to memory of 1272 4360 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe 91 PID 1272 wrote to memory of 4092 1272 RECYCLER.EXE 94 PID 1272 wrote to memory of 4092 1272 RECYCLER.EXE 94 PID 1272 wrote to memory of 4092 1272 RECYCLER.EXE 94 PID 1272 wrote to memory of 4092 1272 RECYCLER.EXE 94 PID 4360 wrote to memory of 5020 4360 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe 95 PID 4360 wrote to memory of 5020 4360 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe 95 PID 4360 wrote to memory of 5020 4360 8ca5f1fa2d996a25c0d7d46e8a0725a2.exe 95 PID 4092 wrote to memory of 2732 4092 IEXPLORE.EXE 97 PID 4092 wrote to memory of 2732 4092 IEXPLORE.EXE 97 PID 4092 wrote to memory of 2732 4092 IEXPLORE.EXE 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ca5f1fa2d996a25c0d7d46e8a0725a2.exe"C:\Users\Admin\AppData\Local\Temp\8ca5f1fa2d996a25c0d7d46e8a0725a2.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\RECYCLER.EXE"C:\Program Files\Common Files\Microsoft Shared\MSINFO\RECYCLER.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4092 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""2⤵PID:5020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172B
MD5927852231949a3349759bf1b81099a00
SHA1859edef102d3daef447a34a2c2db8b3e54a18bf0
SHA2564fe401c28161efc84b7a28d236c79680fd6bc5631d23533ccaa3afe8a13e1297
SHA512cbdcb8194be39dfea6015182a57d043c9e2de807e96283fcc967a243a9f8d6223cca4190082408dfb5b213f08aae0a2a4444787425f22f8c033b2ea8533fe3fb
-
Filesize
524KB
MD563da2513b4156f984b19fb009507d721
SHA10df317b683f9d7d34f234cd9e9403f75c4918c1b
SHA256acf20cc28f671c649120e20a60296a941c5f282cade4eb129d86148dd877e803
SHA5120a2023b8f168e05366a6975d0bb8aeb68390a2c601a630531ee6102998dd98378a9deb1da7b1fd90cc48f35ec3cf4b2cce35a2b555edcd0577dc0568b7e66a50
-
Filesize
184B
MD5095b5a7603826bc82c0715bb4e020857
SHA1ad0058751abc54e94f3f006a550da5ad9b77a19b
SHA256957d0e448031ac5ee780eac63970e355a67d083cecf02999ca655e81e29ffa87
SHA5129edcf303d8562589708eb04fdb85c1a0770fe11de8e244051dcc664e13305c637e9063b10a50f90b25775e76ebbe09a6bea255887bea02d4f51dd20acd17de25
-
Filesize
646KB
MD53f55f18044d59d8ae9a14c1efb1116c4
SHA1f65ab6e5ff16affc96866785848eece4a55d075a
SHA256d5f07ed5bc39e7bd1e2270d6bce8e9633ddcc4f8aa45406265d6bdfa5a66e636
SHA512a34765e813f49e6be769b7c9dfd910f715f7197844e6562ebf1a6c8062949bd1d8613f5ca6df605d4ff00b75be8f6a4c51b97b0c1305daff61bbde09a4ca6aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD552bfc02b370f1b48b834ce1c58ad6560
SHA1d3dbca3ed04caabf69ec8d525a83cde0919809cf
SHA256fce02a7cb2ed194e21949d8a394e69f1dd30c4c517addc831018b8a0b7235a97
SHA5125fb4c1b2d4173f5de1237e2fd55b9081b99756217d5d639da3e0e1bbe339d87be2e9b732ef783446bdedee2af8730e4bedb3184d58ba0bce0881ddc199495289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD52db673590c5a15126b128570d1b2d3bb
SHA17c7163ef647b8be3cbebb8e053a1a21ed62e5ea8
SHA256373a5d8f5d297372eae3ad761e8beaad18b995b47d6c6505f410042e8df49f65
SHA512e9e4d1bbe455304735ff92c322495bbad4e84df539303543dce32589f7af8cab039d1c746e352a335136efc9a7df41936a76348f910243b325f9d74d1c2cb900
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
912KB
MD58ca5f1fa2d996a25c0d7d46e8a0725a2
SHA1bef0493452f8830663321cc19d6f98f01f27c152
SHA256547b319609a15ad9aa358122f6730843ae541d6dc6b6c3ecc0135767664bf865
SHA5127a03715caa48029ec35dd283652c12a94a5a97d1aa14a949c8ea40334feea569aaf1fb8b9ac4e5e7a8d62b08a53025967354ebc365308597ef8bfa8f7287eb5f