modiloader | 747bc5eb611f174f110900d2466ee7a061f934ffb64932db2fad4af386731088

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d0a42410cef8bb15fd372a3676ac3d4.exe
Size 856KB
Sample240203-w3vmksfef4
SHA256 747bc5eb611f174f110900d2466ee7a061f934ffb64932db2fad4af386731088
MD5 8d0a42410cef8bb15fd372a3676ac3d4
SHA1 40af8a948e2bd9845e511842b631fbd1858fb02b
SHA512 da1894b627f04ad01cf3363b08fd1d7150e0fed5ba63e0aa27c51965a88f1df29292b183a71fa80f61fdd69451b6551840d301c0b2ceb13ac807af38232ded6a
SSDEEP 12288:cJjCWhgzbBK8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgP1PikA43xsr4Y2a6A2nChuUr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zaoero.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	HM23Yh.exe

ModiLoader Second Stage 10 IoCs

resource	yara_rule
behavioral2/memory/2712-4-0x0000000000400000-0x0000000000420000-memory.dmp	modiloader_stage2
behavioral2/memory/1344-6-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral2/memory/1344-7-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral2/files/0x00020000000228c7-51.dat	modiloader_stage2
behavioral2/files/0x00020000000228c7-59.dat	modiloader_stage2
behavioral2/memory/1424-61-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral2/files/0x0016000000023113-64.dat	modiloader_stage2
behavioral2/memory/1908-72-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral2/memory/1344-74-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral2/memory/1344-127-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	HM23Yh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	8d0a42410cef8bb15fd372a3676ac3d4.exe

Executes dropped EXE 10 IoCs

pid	Process
1248	HM23Yh.exe
816	zaoero.exe
1424	awhost.exe
3500	awhost.exe
1908	bwhost.exe
4852	bwhost.exe
4808	cwhost.exe
2404	dwhost.exe
2812	X
1576	ewhost.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1344-0-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1344-1-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1344-5-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1344-6-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1344-7-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/4852-66-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/4852-67-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/1344-74-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/4852-76-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/4852-73-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/4852-77-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/4852-103-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/1344-127-0x0000000000400000-0x000000000052D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /k"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /c"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /O"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /N"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /q"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /r"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /X"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /a"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /W"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /G"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /u"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /B"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /R"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /b"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /i"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /C"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /f"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /H"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /E"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /d"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /P"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /Y"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /Z"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /A"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /z"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /g"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /J"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /n"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /K"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /x"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /y"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /F"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /Q"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /T"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /m"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /j"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /w"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /I"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /v"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /t"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /p"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /s"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /L"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /D"	HM23Yh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /U"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /l"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /o"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /M"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /V"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /e"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /h"	zaoero.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoero = "C:\\Users\\Admin\\zaoero.exe /D"	zaoero.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	awhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	awhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bwhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	bwhost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 1424 set thread context of 3500	1424	awhost.exe	103
PID 1908 set thread context of 4852	1908	bwhost.exe	105
PID 2404 set thread context of 2088	2404	dwhost.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1180	tasklist.exe
4964	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1248	HM23Yh.exe
1248	HM23Yh.exe
1248	HM23Yh.exe
1248	HM23Yh.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
3500	awhost.exe
3500	awhost.exe
816	zaoero.exe
816	zaoero.exe
3500	awhost.exe
3500	awhost.exe
3500	awhost.exe
3500	awhost.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
4852	bwhost.exe
4852	bwhost.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
3500	awhost.exe
3500	awhost.exe
3500	awhost.exe
3500	awhost.exe
816	zaoero.exe
816	zaoero.exe
2812	X
2812	X
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
3500	awhost.exe
3500	awhost.exe
3500	awhost.exe
3500	awhost.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe
816	zaoero.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	tasklist.exe
Token: SeDebugPrivilege	2404	dwhost.exe
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeDebugPrivilege	1180	tasklist.exe
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1344	8d0a42410cef8bb15fd372a3676ac3d4.exe
1248	HM23Yh.exe
816	zaoero.exe
1576	ewhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3428	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 2712 wrote to memory of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 2712 wrote to memory of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 2712 wrote to memory of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 2712 wrote to memory of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 2712 wrote to memory of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 2712 wrote to memory of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 2712 wrote to memory of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 2712 wrote to memory of 1344	2712	8d0a42410cef8bb15fd372a3676ac3d4.exe	93
PID 1344 wrote to memory of 1248	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	94
PID 1344 wrote to memory of 1248	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	94
PID 1344 wrote to memory of 1248	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	94
PID 1248 wrote to memory of 816	1248	HM23Yh.exe	96
PID 1248 wrote to memory of 816	1248	HM23Yh.exe	96
PID 1248 wrote to memory of 816	1248	HM23Yh.exe	96
PID 1248 wrote to memory of 3268	1248	HM23Yh.exe	97
PID 1248 wrote to memory of 3268	1248	HM23Yh.exe	97
PID 1248 wrote to memory of 3268	1248	HM23Yh.exe	97
PID 3268 wrote to memory of 4964	3268	cmd.exe	99
PID 3268 wrote to memory of 4964	3268	cmd.exe	99
PID 3268 wrote to memory of 4964	3268	cmd.exe	99
PID 1344 wrote to memory of 1424	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	100
PID 1344 wrote to memory of 1424	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	100
PID 1344 wrote to memory of 1424	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	100
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1424 wrote to memory of 3500	1424	awhost.exe	103
PID 1344 wrote to memory of 1908	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	104
PID 1344 wrote to memory of 1908	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	104
PID 1344 wrote to memory of 1908	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	104
PID 1908 wrote to memory of 4852	1908	bwhost.exe	105
PID 1908 wrote to memory of 4852	1908	bwhost.exe	105
PID 1908 wrote to memory of 4852	1908	bwhost.exe	105
PID 1908 wrote to memory of 4852	1908	bwhost.exe	105
PID 1908 wrote to memory of 4852	1908	bwhost.exe	105
PID 1908 wrote to memory of 4852	1908	bwhost.exe	105
PID 1908 wrote to memory of 4852	1908	bwhost.exe	105
PID 1908 wrote to memory of 4852	1908	bwhost.exe	105
PID 1908 wrote to memory of 4852	1908	bwhost.exe	105
PID 1344 wrote to memory of 4808	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	106
PID 1344 wrote to memory of 4808	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	106
PID 1344 wrote to memory of 4808	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	106
PID 4808 wrote to memory of 4508	4808	cwhost.exe	107
PID 4808 wrote to memory of 4508	4808	cwhost.exe	107
PID 4808 wrote to memory of 4508	4808	cwhost.exe	107
PID 4808 wrote to memory of 4508	4808	cwhost.exe	107
PID 1344 wrote to memory of 2404	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	108
PID 1344 wrote to memory of 2404	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	108
PID 1344 wrote to memory of 2404	1344	8d0a42410cef8bb15fd372a3676ac3d4.exe	108
PID 2404 wrote to memory of 2812	2404	dwhost.exe	109
PID 2404 wrote to memory of 2812	2404	dwhost.exe	109
PID 2812 wrote to memory of 3428	2812	X	61
PID 2404 wrote to memory of 2088	2404	dwhost.exe	111
PID 2404 wrote to memory of 2088	2404	dwhost.exe	111
PID 2404 wrote to memory of 2088	2404	dwhost.exe	111
PID 2404 wrote to memory of 2088	2404	dwhost.exe	111

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3428
- C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe
  "C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\8d0a42410cef8bb15fd372a3676ac3d4.exe
    8d0a42410cef8bb15fd372a3676ac3d4.exe
    3⤵
    - Checks computer location settings
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Users\Admin\HM23Yh.exe
      C:\Users\Admin\HM23Yh.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\Users\Admin\zaoero.exe
        
        "C:\Users\Admin\zaoero.exe"
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:816
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3268
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964
  - - C:\Users\Admin\awhost.exe
      C:\Users\Admin\awhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Users\Admin\awhost.exe
        
        awhost.exe
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3500
  - - C:\Users\Admin\bwhost.exe
      C:\Users\Admin\bwhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\Users\Admin\bwhost.exe
        
        bwhost.exe
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4852
  - - C:\Users\Admin\cwhost.exe
      C:\Users\Admin\cwhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Windows\explorer.exe
        
        000001D8*
        5⤵
        
        PID:4508
  - - C:\Users\Admin\dwhost.exe
      C:\Users\Admin\dwhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Users\Admin\AppData\Local\f8310c6e\X
        
        193.105.154.210:80
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2812
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:2088
  - - C:\Users\Admin\ewhost.exe
      C:\Users\Admin\ewhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del 8d0a42410cef8bb15fd372a3676ac3d4.exe
      4⤵
      PID:4576
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\f8310c6e\X
Size 41KB
SHA256 fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b
MD5 686b479b0ee164cf1744a8be359ebb7d
SHA1 8615e8f967276a85110b198d575982a958581a07
SHA512 7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64
SSDEEP 768:kfEyKizYbbZzzASzQP1MmYkYlIAMtG+aYVSlTAdSv8:cbKizYbVvmFY7MtxSv8
MD5 SHA1 SHA512 SSDEEP

Submit Download

HM23Yh.exe

Path C:\Users\Admin\HM23Yh.exe
Size 224KB
SHA256 438f71f74c972c3ed35a21bbc93cbc8dd1fb3cf17fd789ae730e60e53816b472
MD5 b9204dce58a6e81de3b3306eb6cb03e5
SHA1 ceb777de961f82c42b9b71dca67b8e56a31908a3
SHA512 f555f397416efd33bf9591dd08ad27a4dfed1d26cbfb9d73dc4c3ae130da8ce254d4bfc1e70406f3c92565d28e045469b3ba3b172bd5d19c5876708bb1aa37ed
SSDEEP 6144:GJNyzDFdn53qLowKnvmb7/D26NID5UR2uNhVc5QTI/MfqZN:GvkTn53qLowKnvmb7/D26rVc5AIMfqZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

awhost.exe

Path C:\Users\Admin\awhost.exe
Size 270KB
SHA256 db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b
MD5 5efdb148d618a6b6d2369fccd60f4212
SHA1 7e2045b55c33af87848088738215af2bf7ad0b9b
SHA512 e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21
SSDEEP 6144:1OYzDhHU8CWhgzbJTEiV4+AOiHSn8nCqbI0Ko:LJjCWhgzbBEi2+AOiHS8nCqbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

awhost.exe

Path C:\Users\Admin\awhost.exe
Size 185KB
SHA256 69f04e8360d20e5cd94859041ee5d76c5e01d09fd6b8ef5b71aaa7f83772d4b5
MD5 b07b737759893ad387d4f0a17eb77055
SHA1 aa7b72ae3d985848e056f1f9c118dac24148bb5d
SHA512 77ac990ab2605860c9ddb1d7210e3775141fd638413960ded1e7ed5a5d2061464eadfbf85cf3f2fe5d1e41a304219db453f2f46cd50229be47ea1c88156ad225
SSDEEP 3072:1OYzDhHUU9URdohgivkSDmNrvRUyWmtJ57nNL19iU9T7Uv3/RJjuV1bbQj+PYBE6:1OYzDhHU8CWhgzbJTEiV4+AOiHS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

bwhost.exe

Path C:\Users\Admin\bwhost.exe
Size 157KB
SHA256 00d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9
MD5 2dd258fd2e5a7fccd81b8af93c08780b
SHA1 a5373acdb7f4684b032954e9e754593ddcc827b2
SHA512 20048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df
SSDEEP 3072:6OYzDhHUU9URdohgivkSDmNrvRUyWmtJ57nNL19i09TXtAF2VqYVz2Z/E72yyEOY:6OYzDhHU8CWhgzbJTvvVqYAxgyEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

cwhost.exe

Path C:\Users\Admin\cwhost.exe
Size 150KB
SHA256 8cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948
MD5 d91ada984db5e7adbf2b80c2284c12f6
SHA1 31e9b27095ac041687b016006f41ea6e5222202d
SHA512 8a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748
SSDEEP 3072:5uhpcSPMBSQOI+3CSF2FZ5fsCCJpmjLKjwYoCpRoyEDU9:up3QOL3CfT5ktJwPKJoCpmyEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwhost.exe

Path C:\Users\Admin\dwhost.exe
Size 333KB
SHA256 d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d
MD5 1aceb282a6d05fcc08f3f74f5483bf0a
SHA1 778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b
SHA512 5f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8
SSDEEP 6144:i4ECiH6w+Z4+pAIcLtnKMpCscJz0+nkrTTW/hsV/sdghP57YhfV6p2P:bE1Hfi4ZIcLt1cJz05HW/hB0P+NY0P
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewhost.exe

Path C:\Users\Admin\ewhost.exe
Size 36KB
SHA256 e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96
MD5 4bcd12fdaa17197a658a5113af9120ec
SHA1 3ac79b0b793e390cf1dea82c1754ec34aab1ea46
SHA512 dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd
SSDEEP 384:aYKRB+z+sOL5273onMM1C6FYcBjKuPKz2ZkF31XVSGS8ph4ZoXD3W4MSEa:aYKR0Rv7C3BBj9A2U31XQVxg7vE
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaoero.exe

Path C:\Users\Admin\zaoero.exe
Size 224KB
SHA256 b08408af2e71b242addf461df2b4fb0c707ad7778d3abc2d966af896088ac915
MD5 55ad3d3610ee9385d803247bc092fe9c
SHA1 2dd3f063e1508cf4527d4ace3276b21c0b5cd928
SHA512 f52228a6cdb0d1cf1f3994efe910b125d7f8100c46ef1bb094bd8a34808fc6d46be7352eadba1dd55b220fc2fde92fe2b76986ab0fc72a34e7eaf71db7ac426d
SSDEEP 6144:GJi5Fdn53qLowKnvmb7/D26NID5UR2uNhVc5QTI/MfqZN:GMVn53qLowKnvmb7/D26rVc5AIMfqZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1344-6-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1344-7-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1344-1-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1344-5-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1344-127-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1344-0-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1344-74-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1424-61-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1908-72-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2404-94-0x0000000000400000-0x0000000000462FF0-memory.dmp

Download

memory/2404-95-0x0000000000740000-0x0000000000840000-memory.dmp

Download

memory/2404-112-0x0000000000400000-0x0000000000462FF0-memory.dmp

Download

memory/2404-106-0x0000000000400000-0x0000000000462FF0-memory.dmp

Download

memory/2712-4-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3428-101-0x0000000000CB0000-0x0000000000CB8000-memory.dmp

Download

memory/3500-57-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3500-56-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3500-102-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3500-62-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3500-53-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3500-54-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3500-55-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4508-89-0x0000000000100000-0x0000000000115000-memory.dmp

Download

memory/4808-84-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4808-87-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4808-86-0x00000000020E3000-0x00000000020E4000-memory.dmp

Download

memory/4808-85-0x00000000020E0000-0x0000000002124000-memory.dmp

Download

memory/4808-83-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4808-82-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4808-81-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4852-77-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4852-103-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4852-73-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4852-76-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4852-67-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4852-66-0x0000000000400000-0x0000000000428000-memory.dmp

Download