Analysis

  • max time kernel
    93s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 16:04

General

  • Target

    8cc0bb1a00157351cf02c2d97c0b1831.exe

  • Size

    652KB

  • MD5

    8cc0bb1a00157351cf02c2d97c0b1831

  • SHA1

    b2f154a92ffb170c64d4c222ee6846d996f2761b

  • SHA256

    555bc25a57d01bbb12b69d41995c7a4f41c86f7d05ce0e73d2cc95aa6e3775fd

  • SHA512

    5f32589913beb077b2fc1c392a0cd5f0851511fa714253a7f7366ac0213ec67d5cc2acd06b40af55cc09801720122179ecb6fde1dbbc08b0972d3efcaff9a4f2

  • SSDEEP

    12288:/e6g5JKP/Ic71V0ao0WADIyJjcSoF3Z4mxxPALW3mZxMZtk:W6g5MPl3Xlc9QmXPAi3qxMZt

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cc0bb1a00157351cf02c2d97c0b1831.exe
    "C:\Users\Admin\AppData\Local\Temp\8cc0bb1a00157351cf02c2d97c0b1831.exe"
    1⤵
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\KAV2007.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\KAV2007.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\system32\svchost.exe"
        3⤵
          PID:2296
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 12
            4⤵
            • Program crash
            PID:2092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2296 -ip 2296
      1⤵
        PID:1588

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files\Common Files\Microsoft Shared\MSINFO\KAV2007.exe

              Filesize

              68KB

              MD5

              8685fd6e340191c57a725d37da4c2041

              SHA1

              41f742f4ccabe7e92105f91d576f9ad8b5c7fd9d

              SHA256

              e488a48cb41f6e0a6f42bd3191cb9a1b9a801ff59ada7698fd6b03306384c73c

              SHA512

              800fa36eb907a4571c4f4d18e4f533aeba779c03326ac39652c83613fda6d248c3aef1c0b6d0437553cfe2f9e1408e7e7ffa3dc12404e6312c6c35ef5d4f7d79

            • C:\Program Files\Common Files\microsoft shared\MSInfo\KAV2007.exe

              Filesize

              57KB

              MD5

              71959f3d95511c35829be4ec361a1de0

              SHA1

              a483167050aee0dcfe7b129de074a6cc691b5280

              SHA256

              526d912f7393d4bd60a685935a3f52ab406821d6d7bfadaf806543b3325da8df

              SHA512

              f26fba85322bdb80998df1a9c4a7e305ee58e238f732658202b17b9aa9ca4c99e8b70b8a865fe4484e2e3fc0b3343e5105c618bf434e05ff7a256e1b68797030

            • F:\KAV2007.exe

              Filesize

              157KB

              MD5

              63f6545f346ba674df9fd99d79232204

              SHA1

              785bc1983450cc8c47bcd00ce7169f425685bba7

              SHA256

              b61eab79f4db2f7a3dea01ccf8aadcdff5d27ca10b6e2a19f94654d4c8f5ecf7

              SHA512

              a7ce03626e5c93019055c66c649d8afe1e904ddc850955dbc631177fe955191b9c77d3f535c3f0bdb39a868c18fdb283d1625b880137cda0b8da44f61491efd0

            • memory/2136-27-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-70-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-2-0x0000000002600000-0x0000000002601000-memory.dmp

              Filesize

              4KB

            • memory/2136-3-0x0000000002650000-0x0000000002651000-memory.dmp

              Filesize

              4KB

            • memory/2136-49-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-21-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-9-0x00000000025F0000-0x00000000025F1000-memory.dmp

              Filesize

              4KB

            • memory/2136-8-0x0000000002660000-0x0000000002661000-memory.dmp

              Filesize

              4KB

            • memory/2136-7-0x0000000002630000-0x0000000002631000-memory.dmp

              Filesize

              4KB

            • memory/2136-6-0x0000000002640000-0x0000000002641000-memory.dmp

              Filesize

              4KB

            • memory/2136-5-0x00000000025D0000-0x00000000025D1000-memory.dmp

              Filesize

              4KB

            • memory/2136-24-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-25-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-23-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-22-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-4-0x00000000025E0000-0x00000000025E1000-memory.dmp

              Filesize

              4KB

            • memory/2136-26-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-32-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-31-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-40-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-41-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-39-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-38-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-37-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-36-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-35-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-34-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-33-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-30-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-29-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-28-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-0-0x0000000000400000-0x00000000005DB000-memory.dmp

              Filesize

              1.9MB

            • memory/2136-18-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-1-0x00000000023F0000-0x0000000002444000-memory.dmp

              Filesize

              336KB

            • memory/2136-50-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-54-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-73-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-72-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-71-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-69-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-68-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-67-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-94-0x0000000000400000-0x00000000005DB000-memory.dmp

              Filesize

              1.9MB

            • memory/2136-66-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-65-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-64-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-63-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-62-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-60-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-59-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-58-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-57-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-56-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-55-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-53-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-52-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-51-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-61-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-48-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-47-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-46-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-45-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-44-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-43-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2136-42-0x00000000035C0000-0x00000000036C0000-memory.dmp

              Filesize

              1024KB

            • memory/2296-92-0x0000000000400000-0x00000000005DB000-memory.dmp

              Filesize

              1.9MB

            • memory/4880-93-0x0000000000400000-0x00000000005DB000-memory.dmp

              Filesize

              1.9MB