Analysis

  • max time kernel
    33s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 17:49

General

  • Target

    8cf591136fec7bd474a84c232e01155a.exe

  • Size

    719KB

  • MD5

    8cf591136fec7bd474a84c232e01155a

  • SHA1

    2e7abf19970c4bfe1bd7a83542d31dec71aa2240

  • SHA256

    791e84d0017b4fabe903ae49cf3379bfd333c23d927b402d85e9d9bd669ba52f

  • SHA512

    45d581c3c406c3959b240d16f5ac409e7ac8c68718dfe96e57315adc6f21e3c6d94434cc6f9f5843e4a616559e0e663d1bd2d023f92e5ed03d7128c2a4e08235

  • SSDEEP

    12288:6XgPVmsO7H+JeYkZQors8sEyMGXxeDlX4EEPSwDfAmgBJbf8AwnBrRm8dZ/X:AoZ3J78GEX4bEmCb+rRvZ/X

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • ModiLoader Second Stage 3 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 18 IoCs
  • Adds Run key to start application 2 TTPs 20 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cf591136fec7bd474a84c232e01155a.exe
    "C:\Users\Admin\AppData\Local\Temp\8cf591136fec7bd474a84c232e01155a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\B85EgtCQKi4p6Z9Kt2.exe
      B85EgtCQKi4p6Z9Kt2.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Users\Admin\vxwom.exe
        "C:\Users\Admin\vxwom.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2732
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del B85EgtCQKi4p6Z9Kt2.exe
        3⤵
          PID:2036
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            PID:2956
      • C:\Users\Admin\cod.exe
        cod.exe
        2⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of AdjustPrivilegeToken
        PID:2932
      • C:\Users\Admin\cof.exe
        cof.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\mfwutese.dll",Startup
          3⤵
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe "C:\Users\Admin\AppData\Local\mfwutese.dll",iep
            4⤵
            • Loads dropped DLL
            PID:2460
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c del 8cf591136fec7bd474a84c232e01155a.exe
        2⤵
        • Deletes itself
        PID:2872
      • C:\Users\Admin\cog.exe
        cog.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1252
    • C:\Users\Admin\cog.exe
      cog.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2084

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\mfwutese.dll

            Filesize

            103KB

            MD5

            be60099ceffb0aece0bc0c52998e9d65

            SHA1

            6ff11181390b5eccfb9a832ea5311d58bcc7a3a3

            SHA256

            e41f195954abff7c7bdc150773ad9f0b4029a883386ac179c1aa9d44f9ab6e4a

            SHA512

            c4beef5b86370a959b624041cc2db1de2da07a15df17077d728ea74036398fd1e62b6e7e147c53ea944606d751d0934f423b70193ad570a8cba097a823facdc0

          • C:\Users\Admin\cod.exe

            Filesize

            148KB

            MD5

            b8e09161bc02d31d1ae2c99e258144ee

            SHA1

            0ccaf9daa161cb90936862f4f8f061afc671c3ca

            SHA256

            6bdf47160d6aa55f0c3f646512107d589f91c0231e95352eff690f5f1fa7b9ad

            SHA512

            489fb5908765d103bc0f3187f3784500acfe9f0f6dce75e4e7d6964576b01efeba2cf83132b95b3f5e84a1ba6dc2b969cdc367a6b9dbe348e52259690c7fed77

          • C:\Users\Admin\cod.exe

            Filesize

            72KB

            MD5

            1c7b201413e0761653f61eb45886e00d

            SHA1

            d58ff7e56db798240c5a09b33002bbc9b1b50f60

            SHA256

            16390ac3f6c7783604f5cbdc6f157d358b31956a79d2bbe2bdd60a0632fe65b6

            SHA512

            9ba3d4add08a6501ca0c6dbe84ae3d3907ebc9bcb996e11ffca97e6406ab0999060640a1df7f34db8dc95909c5be8501119c81c83150362b19fd6c50d372f10a

          • C:\Users\Admin\cof.exe

            Filesize

            45KB

            MD5

            6d6ff934d61f37f4b292da43125f8fc9

            SHA1

            5b56e2404862ef7fe7b42158abe6bb344743792e

            SHA256

            bd06e54c7ce441b88d84bd2ef758017c6740663c0158784e55def171c7986df8

            SHA512

            a135fe5da7b1553a01c752f0162703c9c6428586f349097eb5f7adad722dfb67289e7ff1297a44f321ad7e5cafd2694f5a544291ea660a6daa8cb3fbea8e8e0c

          • C:\Users\Admin\cof.exe

            Filesize

            103KB

            MD5

            d15f3d9213e5972e1e2c069448d6f228

            SHA1

            224f67d7bcb15f1921211d68df19a072dc84ccfe

            SHA256

            9c0e3fcd2615c0a3678e77583970c5d9401ea223db3e517d048453db6427214d

            SHA512

            3e53dde211235f50f7507839f4f0e8ef6c0456f4f92b40e3a9d57eb64c1ee17774698858213e1cdefb8e87803648ff97001b2a00ad2c2c6b0c896774b1e785e3

          • C:\Users\Admin\cog.exe

            Filesize

            85KB

            MD5

            44e27b6521dd2c9375f0d1e4737878a3

            SHA1

            6a073519fdff88a36bf7837b5636d6814f05255a

            SHA256

            2414245b0355f11217eeed564ecbbd70e362a886982587e968739bc8a24d9290

            SHA512

            01eecad2bb7a2017f77d7df4cc0bf513e15b331108934357db246b9f538f14114cfa31b9c36aac0fca081b57bb9255567517575fb2f613e7eba1b71e59999deb

          • C:\Users\Admin\cog.exe

            Filesize

            145KB

            MD5

            262a039229f90ba2461f2e810ad74447

            SHA1

            9dfe5040a3d6ea8262313953c02a1e6ae39c6916

            SHA256

            e20729c3095a40a637efb304bdf57902cd4948f22406138e0dbdf28f034cedb3

            SHA512

            d7612cdbc38aea73462aa7851ab3078dfb89a1b4c96414f5d8144c456f694971f08a79bbb1a738ffeb273f99122432b1009cbf4bd483884dd50ca115a64ef641

          • \Users\Admin\B85EgtCQKi4p6Z9Kt2.exe

            Filesize

            152KB

            MD5

            72e9d71fe7ad21610b846614566d6e2f

            SHA1

            35071ef247823ff6fa675449c6506caa2f5b145f

            SHA256

            4dc0b35a38321c71c24289acf43c102e6aa875307f830900d39f25491c83cda9

            SHA512

            14431710838e2eea0fdb3a7b73743b6d101ec6a4ceebdf0716e2855e845bd2b1722e5178d310a24ce7e5754076a9dc0e62f351c1518c391c6db8533af35203f3

          • \Users\Admin\cod.exe

            Filesize

            176KB

            MD5

            dbadc5fadb7497f5761537c06026ff47

            SHA1

            c8bd7319e170bd5966a73bae6f34cee4782b4f97

            SHA256

            b8fdc5c5f8aa378ef3ba8ee5172550a8f7ca295bebe858dab8ec171f1328036e

            SHA512

            7bced6bbdeb0f770d78f199d16d8ed86e90794141df101d1bb4878c55313af058a5551e0df2da65f6cd3507185cca13c7459aabf97c22faa83518b53321c2b7e

          • \Users\Admin\vxwom.exe

            Filesize

            152KB

            MD5

            2aa64c61b9e9b5549381bca685d8330e

            SHA1

            71a9c89bda77874d5b6c3d09c89ad7fa5e447725

            SHA256

            c873b45875b1c894b9b5b2cf16b7ff85f065373b87ee5c498ffbfe14d2f620c8

            SHA512

            420e2be6f20065699999ee42533b97915166203899df4ebafdb26d3814f12598a4d3a77099851d265d2c4534e2ec6f14e04cb688a86286e200e0411870c7ad5b

          • memory/1252-85-0x0000000000400000-0x0000000000427000-memory.dmp

            Filesize

            156KB

          • memory/2084-81-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2084-77-0x0000000000400000-0x000000000040B000-memory.dmp

            Filesize

            44KB

          • memory/2084-64-0x0000000000400000-0x000000000040B000-memory.dmp

            Filesize

            44KB

          • memory/2084-66-0x0000000000400000-0x000000000040B000-memory.dmp

            Filesize

            44KB

          • memory/2084-87-0x0000000000400000-0x000000000040B000-memory.dmp

            Filesize

            44KB

          • memory/2084-68-0x0000000000400000-0x000000000040B000-memory.dmp

            Filesize

            44KB

          • memory/2084-71-0x0000000000400000-0x000000000040B000-memory.dmp

            Filesize

            44KB

          • memory/2084-74-0x0000000000400000-0x000000000040B000-memory.dmp

            Filesize

            44KB

          • memory/2084-86-0x0000000000400000-0x000000000040B000-memory.dmp

            Filesize

            44KB

          • memory/2084-80-0x0000000000400000-0x000000000040B000-memory.dmp

            Filesize

            44KB

          • memory/2292-128-0x0000000002F90000-0x0000000003A4A000-memory.dmp

            Filesize

            10.7MB

          • memory/2460-125-0x0000000000180000-0x00000000001C0000-memory.dmp

            Filesize

            256KB

          • memory/2460-126-0x0000000000180000-0x00000000001C0000-memory.dmp

            Filesize

            256KB

          • memory/2556-107-0x0000000010000000-0x000000001001D000-memory.dmp

            Filesize

            116KB

          • memory/2556-59-0x0000000010000000-0x000000001001D000-memory.dmp

            Filesize

            116KB

          • memory/2556-120-0x0000000010000000-0x000000001001D000-memory.dmp

            Filesize

            116KB

          • memory/2556-61-0x00000000001E0000-0x0000000000220000-memory.dmp

            Filesize

            256KB

          • memory/2556-60-0x00000000001E0000-0x0000000000220000-memory.dmp

            Filesize

            256KB

          • memory/2636-22-0x0000000000470000-0x00000000004C8000-memory.dmp

            Filesize

            352KB

          • memory/2636-17-0x0000000000470000-0x00000000004C8000-memory.dmp

            Filesize

            352KB

          • memory/2932-46-0x00000000006C0000-0x0000000000718000-memory.dmp

            Filesize

            352KB

          • memory/2932-37-0x0000000000400000-0x0000000000458000-memory.dmp

            Filesize

            352KB

          • memory/2932-62-0x0000000000400000-0x0000000000458000-memory.dmp

            Filesize

            352KB

          • memory/2932-48-0x0000000000400000-0x0000000000458000-memory.dmp

            Filesize

            352KB

          • memory/2932-47-0x00000000006C1000-0x00000000006C2000-memory.dmp

            Filesize

            4KB

          • memory/2932-43-0x0000000000400000-0x0000000000458000-memory.dmp

            Filesize

            352KB

          • memory/2932-41-0x0000000000400000-0x0000000000458000-memory.dmp

            Filesize

            352KB

          • memory/2940-52-0x0000000010000000-0x000000001001D000-memory.dmp

            Filesize

            116KB

          • memory/2940-38-0x0000000010000000-0x000000001001D000-memory.dmp

            Filesize

            116KB

          • memory/2940-44-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

            Filesize

            256KB

          • memory/2940-40-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

            Filesize

            256KB