Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 18:27

General

  • Target

    8d0a42410cef8bb15fd372a3676ac3d4.exe

  • Size

    856KB

  • MD5

    8d0a42410cef8bb15fd372a3676ac3d4

  • SHA1

    40af8a948e2bd9845e511842b631fbd1858fb02b

  • SHA256

    747bc5eb611f174f110900d2466ee7a061f934ffb64932db2fad4af386731088

  • SHA512

    da1894b627f04ad01cf3363b08fd1d7150e0fed5ba63e0aa27c51965a88f1df29292b183a71fa80f61fdd69451b6551840d301c0b2ceb13ac807af38232ded6a

  • SSDEEP

    12288:cJjCWhgzbBK8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgP1PikA43xsr4Y2a6A2nChuUr

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • ModiLoader Second Stage 11 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 18 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 52 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe
      "C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe
        8d0a42410cef8bb15fd372a3676ac3d4.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2980
        • C:\Users\Admin\HM23Yh.exe
          C:\Users\Admin\HM23Yh.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Users\Admin\soice.exe
            "C:\Users\Admin\soice.exe"
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2820
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2788
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              6⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2548
        • C:\Users\Admin\awhost.exe
          C:\Users\Admin\awhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2808
          • C:\Users\Admin\awhost.exe
            awhost.exe
            5⤵
            • Executes dropped EXE
            • Maps connected drives based on registry
            • Suspicious behavior: EnumeratesProcesses
            PID:1532
        • C:\Users\Admin\bwhost.exe
          C:\Users\Admin\bwhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1840
          • C:\Users\Admin\bwhost.exe
            bwhost.exe
            5⤵
            • Executes dropped EXE
            • Maps connected drives based on registry
            • Suspicious behavior: EnumeratesProcesses
            PID:1896
        • C:\Users\Admin\cwhost.exe
          C:\Users\Admin\cwhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:500
          • C:\Windows\explorer.exe
            00000088*
            5⤵
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1332
        • C:\Users\Admin\dwhost.exe
          C:\Users\Admin\dwhost.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          PID:2184
          • C:\Users\Admin\AppData\Local\9b7b7593\X
            193.105.154.210:80
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:2228
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            5⤵
              PID:2320
          • C:\Users\Admin\ewhost.exe
            C:\Users\Admin\ewhost.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:852
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del 8d0a42410cef8bb15fd372a3676ac3d4.exe
            4⤵
            • Deletes itself
            PID:1956
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2892
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs
      1⤵
        PID:876
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          2⤵
            PID:1560
        • C:\Windows\system32\csrss.exe
          %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
          1⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Suspicious use of UnmapMainImage
          PID:336
        • C:\Windows\system32\wbem\wmiprvse.exe
          C:\Windows\system32\wbem\wmiprvse.exe -Embedding
          1⤵
            PID:1608

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\9b7b7593\@

                  Filesize

                  2KB

                  MD5

                  9f07c4a67dbf752b6e32e815c0ac7728

                  SHA1

                  faef5b8f91e00af204351136aa884ce790c70c55

                  SHA256

                  7ead63d0c9b4261f952aeaacd5a61a99998df9a07f3b5d770e8e7c8910b76651

                  SHA512

                  280cc13e0af907b5779cfda9902dea5618eae5e844e09912f2685c7df52ce9fa15b93eb05f71e52fae30d425a6fa540b29a78210414004f4ba4fc8c87408ce4e

                • C:\Users\Admin\AppData\Local\9b7b7593\X

                  Filesize

                  41KB

                  MD5

                  686b479b0ee164cf1744a8be359ebb7d

                  SHA1

                  8615e8f967276a85110b198d575982a958581a07

                  SHA256

                  fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

                  SHA512

                  7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

                • C:\Users\Admin\ewhost.exe

                  Filesize

                  36KB

                  MD5

                  4bcd12fdaa17197a658a5113af9120ec

                  SHA1

                  3ac79b0b793e390cf1dea82c1754ec34aab1ea46

                  SHA256

                  e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96

                  SHA512

                  dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd

                • C:\Windows\system32\consrv.DLL

                  Filesize

                  52KB

                  MD5

                  c7570a7e24b29ee04a48c2c99da2587b

                  SHA1

                  b6e3635a8de44b1635e8d362ac131e14281feb24

                  SHA256

                  717cd7661c09701ee39c505d8b604ea3dd6c1151ef18e7ed1cab3832552ac34b

                  SHA512

                  57479d2f5386ace8cc5e5ed543e6ad2c2b7b58accc849807d804a8cf0d03080f328f7b42442422fa1483a01ad473ca302f9eca97b9eb24e699e22db56641c572

                • \??\globalroot\systemroot\assembly\temp\@

                  Filesize

                  2KB

                  MD5

                  a47ef07c79e7afc3fa7f2d111b89d04e

                  SHA1

                  29afc89ed82340e258f9e963554095ce98642291

                  SHA256

                  ff7320b34a0247a4bb3cf5e9298ecdabe4d8f9b407793aab0f0cc0279b7b9815

                  SHA512

                  9f0f3f5cc512c95f975f85d163ac621613990ffc3a71ede9907791bfad414745e1f9c0f6819b18a306e42f78802d8501383cf8fbde24535bdaaf9eaa363b1889

                • \Users\Admin\HM23Yh.exe

                  Filesize

                  224KB

                  MD5

                  b9204dce58a6e81de3b3306eb6cb03e5

                  SHA1

                  ceb777de961f82c42b9b71dca67b8e56a31908a3

                  SHA256

                  438f71f74c972c3ed35a21bbc93cbc8dd1fb3cf17fd789ae730e60e53816b472

                  SHA512

                  f555f397416efd33bf9591dd08ad27a4dfed1d26cbfb9d73dc4c3ae130da8ce254d4bfc1e70406f3c92565d28e045469b3ba3b172bd5d19c5876708bb1aa37ed

                • \Users\Admin\awhost.exe

                  Filesize

                  270KB

                  MD5

                  5efdb148d618a6b6d2369fccd60f4212

                  SHA1

                  7e2045b55c33af87848088738215af2bf7ad0b9b

                  SHA256

                  db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b

                  SHA512

                  e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21

                • \Users\Admin\bwhost.exe

                  Filesize

                  157KB

                  MD5

                  2dd258fd2e5a7fccd81b8af93c08780b

                  SHA1

                  a5373acdb7f4684b032954e9e754593ddcc827b2

                  SHA256

                  00d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9

                  SHA512

                  20048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df

                • \Users\Admin\cwhost.exe

                  Filesize

                  150KB

                  MD5

                  d91ada984db5e7adbf2b80c2284c12f6

                  SHA1

                  31e9b27095ac041687b016006f41ea6e5222202d

                  SHA256

                  8cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948

                  SHA512

                  8a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748

                • \Users\Admin\dwhost.exe

                  Filesize

                  333KB

                  MD5

                  1aceb282a6d05fcc08f3f74f5483bf0a

                  SHA1

                  778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b

                  SHA256

                  d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d

                  SHA512

                  5f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8

                • \Users\Admin\soice.exe

                  Filesize

                  224KB

                  MD5

                  c8605857dbc3c225c771854d42e5eab2

                  SHA1

                  09222141916e074b9a062d5940191297b57e1016

                  SHA256

                  2f3d9f1e17b1afe3db1edb08f29f2869cff5296395edff2ea34cf5494857f60c

                  SHA512

                  c01a9a3cb230202bbd3a3ab33d5214aa72a5562c5794395404d4af4003c4c7c217cd0b0d3ad0f40176aa142f6dfabb9f7f4cde0ed762a6e5c79e2aa27ee40da6

                • \Windows\assembly\GAC_32\Desktop.ini

                  Filesize

                  4KB

                  MD5

                  80dbc7d15fdf94f16bb4a739cd9c3f98

                  SHA1

                  c0f3f20b360ce78cc153fa514e5f62c06f68feb7

                  SHA256

                  20b2d1e1b5348ed92f7e2eaedba4348e446970c13c6226f34a816503aa956c91

                  SHA512

                  cf8d820104ee3db4a103fb19d38267fe2f5095a29777bf3bcde95d4299360681cedd421251af92038da3f8709e68f101f7326ad9abdd087a59ca83adec87bc48

                • \Windows\assembly\GAC_64\Desktop.ini

                  Filesize

                  5KB

                  MD5

                  78ab98fd9228277f2638fd93cd703016

                  SHA1

                  1640ee7f500074c155a5af431e9d125a4ec2cea5

                  SHA256

                  e0517a9584af6cfd4f1e6d280e086b20fd576b90b32f9ddac916de03a53b766c

                  SHA512

                  d98ed49a83d5b50737a674e4421cea4cbe353f80234d2d5a8df82995a0d81e9524f23919ca600afb98bc676a8f93e7c0df73c22cae9b3fc624027800ba9dcc76

                • memory/336-147-0x0000000000E50000-0x0000000000E62000-memory.dmp

                  Filesize

                  72KB

                • memory/336-184-0x0000000000E50000-0x0000000000E62000-memory.dmp

                  Filesize

                  72KB

                • memory/500-113-0x0000000000400000-0x0000000000444000-memory.dmp

                  Filesize

                  272KB

                • memory/500-116-0x0000000000400000-0x0000000000444000-memory.dmp

                  Filesize

                  272KB

                • memory/500-118-0x0000000000223000-0x0000000000224000-memory.dmp

                  Filesize

                  4KB

                • memory/500-117-0x0000000000220000-0x0000000000264000-memory.dmp

                  Filesize

                  272KB

                • memory/500-115-0x0000000000400000-0x0000000000444000-memory.dmp

                  Filesize

                  272KB

                • memory/500-120-0x0000000000400000-0x0000000000444000-memory.dmp

                  Filesize

                  272KB

                • memory/500-114-0x0000000000400000-0x0000000000444000-memory.dmp

                  Filesize

                  272KB

                • memory/876-238-0x0000000000BC0000-0x0000000000BCB000-memory.dmp

                  Filesize

                  44KB

                • memory/876-232-0x0000000000BC0000-0x0000000000BCB000-memory.dmp

                  Filesize

                  44KB

                • memory/876-223-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

                  Filesize

                  32KB

                • memory/1100-176-0x00000000024D0000-0x00000000024DB000-memory.dmp

                  Filesize

                  44KB

                • memory/1100-201-0x00000000024D0000-0x00000000024DB000-memory.dmp

                  Filesize

                  44KB

                • memory/1100-174-0x00000000024B0000-0x00000000024B8000-memory.dmp

                  Filesize

                  32KB

                • memory/1332-123-0x00000000000E0000-0x00000000000F5000-memory.dmp

                  Filesize

                  84KB

                • memory/1332-121-0x00000000001F0000-0x0000000000209000-memory.dmp

                  Filesize

                  100KB

                • memory/1332-128-0x00000000001F0000-0x0000000000209000-memory.dmp

                  Filesize

                  100KB

                • memory/1532-56-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1532-54-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1532-52-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1532-59-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1532-75-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1532-68-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1532-65-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1532-62-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/1792-10-0x0000000000400000-0x0000000000420000-memory.dmp

                  Filesize

                  128KB

                • memory/1840-95-0x0000000000400000-0x000000000041F000-memory.dmp

                  Filesize

                  124KB

                • memory/1896-86-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/1896-171-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/1896-103-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/1896-101-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/1896-102-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/1896-100-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/1896-90-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/1896-88-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/1896-84-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/2184-155-0x0000000000510000-0x0000000000610000-memory.dmp

                  Filesize

                  1024KB

                • memory/2184-187-0x0000000000510000-0x0000000000610000-memory.dmp

                  Filesize

                  1024KB

                • memory/2184-154-0x0000000000400000-0x0000000000462FF0-memory.dmp

                  Filesize

                  395KB

                • memory/2184-191-0x0000000000510000-0x0000000000610000-memory.dmp

                  Filesize

                  1024KB

                • memory/2184-190-0x0000000000400000-0x0000000000462FF0-memory.dmp

                  Filesize

                  395KB

                • memory/2184-186-0x0000000000400000-0x0000000000462FF0-memory.dmp

                  Filesize

                  395KB

                • memory/2760-43-0x0000000003EE0000-0x000000000499A000-memory.dmp

                  Filesize

                  10.7MB

                • memory/2808-74-0x0000000000400000-0x000000000041F000-memory.dmp

                  Filesize

                  124KB

                • memory/2980-98-0x0000000000400000-0x000000000052D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2980-14-0x0000000000400000-0x000000000052D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2980-0-0x0000000000400000-0x000000000052D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2980-111-0x00000000002B0000-0x00000000002F4000-memory.dmp

                  Filesize

                  272KB

                • memory/2980-112-0x00000000002B0000-0x00000000002F4000-memory.dmp

                  Filesize

                  272KB

                • memory/2980-13-0x0000000000400000-0x000000000052D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2980-12-0x0000000000400000-0x000000000052D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2980-213-0x0000000000400000-0x000000000052D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2980-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                  Filesize

                  4KB

                • memory/2980-6-0x0000000000400000-0x000000000052D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2980-3-0x0000000000400000-0x000000000052D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2980-2-0x0000000000400000-0x000000000052D000-memory.dmp

                  Filesize

                  1.2MB