Analysis
-
max time kernel
33s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
8cf591136fec7bd474a84c232e01155a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8cf591136fec7bd474a84c232e01155a.exe
Resource
win10v2004-20231215-en
General
-
Target
8cf591136fec7bd474a84c232e01155a.exe
-
Size
719KB
-
MD5
8cf591136fec7bd474a84c232e01155a
-
SHA1
2e7abf19970c4bfe1bd7a83542d31dec71aa2240
-
SHA256
791e84d0017b4fabe903ae49cf3379bfd333c23d927b402d85e9d9bd669ba52f
-
SHA512
45d581c3c406c3959b240d16f5ac409e7ac8c68718dfe96e57315adc6f21e3c6d94434cc6f9f5843e4a616559e0e663d1bd2d023f92e5ed03d7128c2a4e08235
-
SSDEEP
12288:6XgPVmsO7H+JeYkZQors8sEyMGXxeDlX4EEPSwDfAmgBJbf8AwnBrRm8dZ/X:AoZ3J78GEX4bEmCb+rRvZ/X
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vxwom.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" B85EgtCQKi4p6Z9Kt2.exe -
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral1/files/0x0007000000018b6c-39.dat modiloader_stage2 behavioral1/memory/1252-85-0x0000000000400000-0x0000000000427000-memory.dmp modiloader_stage2 behavioral1/files/0x0007000000018b6c-84.dat modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2872 cmd.exe -
Executes dropped EXE 6 IoCs
pid Process 2292 B85EgtCQKi4p6Z9Kt2.exe 2932 cod.exe 2940 cof.exe 1252 cog.exe 2084 cog.exe 2732 vxwom.exe -
Loads dropped DLL 18 IoCs
pid Process 2636 8cf591136fec7bd474a84c232e01155a.exe 2636 8cf591136fec7bd474a84c232e01155a.exe 2636 8cf591136fec7bd474a84c232e01155a.exe 2636 8cf591136fec7bd474a84c232e01155a.exe 2636 8cf591136fec7bd474a84c232e01155a.exe 2636 8cf591136fec7bd474a84c232e01155a.exe 2636 8cf591136fec7bd474a84c232e01155a.exe 2636 8cf591136fec7bd474a84c232e01155a.exe 2556 rundll32.exe 2556 rundll32.exe 2556 rundll32.exe 2556 rundll32.exe 2292 B85EgtCQKi4p6Z9Kt2.exe 2292 B85EgtCQKi4p6Z9Kt2.exe 2460 rundll32.exe 2460 rundll32.exe 2460 rundll32.exe 2460 rundll32.exe -
Adds Run key to start application 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /j" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Msojukemuguxav = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\mfwutese.dll\",Startup" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /D" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /a" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /C" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /L" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /h" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /b" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /o" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /F" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /q" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /E" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /u" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /Z" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /A" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /f" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /z" B85EgtCQKi4p6Z9Kt2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /l" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /T" vxwom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxwom = "C:\\Users\\Admin\\vxwom.exe /y" vxwom.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\physicaldrive0 cod.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1252 set thread context of 2084 1252 cog.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2956 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2084 cog.exe 2292 B85EgtCQKi4p6Z9Kt2.exe 2084 cog.exe 2292 B85EgtCQKi4p6Z9Kt2.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2084 cog.exe 2732 vxwom.exe 2732 vxwom.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2732 vxwom.exe 2732 vxwom.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2084 cog.exe 2732 vxwom.exe 2732 vxwom.exe 2084 cog.exe 2084 cog.exe 2732 vxwom.exe 2084 cog.exe 2084 cog.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2932 cod.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2292 B85EgtCQKi4p6Z9Kt2.exe 2732 vxwom.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2292 2636 8cf591136fec7bd474a84c232e01155a.exe 28 PID 2636 wrote to memory of 2292 2636 8cf591136fec7bd474a84c232e01155a.exe 28 PID 2636 wrote to memory of 2292 2636 8cf591136fec7bd474a84c232e01155a.exe 28 PID 2636 wrote to memory of 2292 2636 8cf591136fec7bd474a84c232e01155a.exe 28 PID 2636 wrote to memory of 2932 2636 8cf591136fec7bd474a84c232e01155a.exe 29 PID 2636 wrote to memory of 2932 2636 8cf591136fec7bd474a84c232e01155a.exe 29 PID 2636 wrote to memory of 2932 2636 8cf591136fec7bd474a84c232e01155a.exe 29 PID 2636 wrote to memory of 2932 2636 8cf591136fec7bd474a84c232e01155a.exe 29 PID 2636 wrote to memory of 2940 2636 8cf591136fec7bd474a84c232e01155a.exe 30 PID 2636 wrote to memory of 2940 2636 8cf591136fec7bd474a84c232e01155a.exe 30 PID 2636 wrote to memory of 2940 2636 8cf591136fec7bd474a84c232e01155a.exe 30 PID 2636 wrote to memory of 2940 2636 8cf591136fec7bd474a84c232e01155a.exe 30 PID 2636 wrote to memory of 1252 2636 8cf591136fec7bd474a84c232e01155a.exe 35 PID 2636 wrote to memory of 1252 2636 8cf591136fec7bd474a84c232e01155a.exe 35 PID 2636 wrote to memory of 1252 2636 8cf591136fec7bd474a84c232e01155a.exe 35 PID 2636 wrote to memory of 1252 2636 8cf591136fec7bd474a84c232e01155a.exe 35 PID 2636 wrote to memory of 2872 2636 8cf591136fec7bd474a84c232e01155a.exe 34 PID 2636 wrote to memory of 2872 2636 8cf591136fec7bd474a84c232e01155a.exe 34 PID 2636 wrote to memory of 2872 2636 8cf591136fec7bd474a84c232e01155a.exe 34 PID 2636 wrote to memory of 2872 2636 8cf591136fec7bd474a84c232e01155a.exe 34 PID 2940 wrote to memory of 2556 2940 cof.exe 32 PID 2940 wrote to memory of 2556 2940 cof.exe 32 PID 2940 wrote to memory of 2556 2940 cof.exe 32 PID 2940 wrote to memory of 2556 2940 cof.exe 32 PID 2940 wrote to memory of 2556 2940 cof.exe 32 PID 2940 wrote to memory of 2556 2940 cof.exe 32 PID 2940 wrote to memory of 2556 2940 cof.exe 32 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 1252 wrote to memory of 2084 1252 cog.exe 33 PID 2292 wrote to memory of 2732 2292 B85EgtCQKi4p6Z9Kt2.exe 36 PID 2292 wrote to memory of 2732 2292 B85EgtCQKi4p6Z9Kt2.exe 36 PID 2292 wrote to memory of 2732 2292 B85EgtCQKi4p6Z9Kt2.exe 36 PID 2292 wrote to memory of 2732 2292 B85EgtCQKi4p6Z9Kt2.exe 36 PID 2556 wrote to memory of 2460 2556 rundll32.exe 37 PID 2556 wrote to memory of 2460 2556 rundll32.exe 37 PID 2556 wrote to memory of 2460 2556 rundll32.exe 37 PID 2556 wrote to memory of 2460 2556 rundll32.exe 37 PID 2556 wrote to memory of 2460 2556 rundll32.exe 37 PID 2556 wrote to memory of 2460 2556 rundll32.exe 37 PID 2556 wrote to memory of 2460 2556 rundll32.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cf591136fec7bd474a84c232e01155a.exe"C:\Users\Admin\AppData\Local\Temp\8cf591136fec7bd474a84c232e01155a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\B85EgtCQKi4p6Z9Kt2.exeB85EgtCQKi4p6Z9Kt2.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\vxwom.exe"C:\Users\Admin\vxwom.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del B85EgtCQKi4p6Z9Kt2.exe3⤵PID:2036
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:2956
-
-
-
-
C:\Users\Admin\cod.execod.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Users\Admin\cof.execof.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\mfwutese.dll",Startup3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\mfwutese.dll",iep4⤵
- Loads dropped DLL
PID:2460
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del 8cf591136fec7bd474a84c232e01155a.exe2⤵
- Deletes itself
PID:2872
-
-
C:\Users\Admin\cog.execog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1252
-
-
C:\Users\Admin\cog.execog.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2084
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD5be60099ceffb0aece0bc0c52998e9d65
SHA16ff11181390b5eccfb9a832ea5311d58bcc7a3a3
SHA256e41f195954abff7c7bdc150773ad9f0b4029a883386ac179c1aa9d44f9ab6e4a
SHA512c4beef5b86370a959b624041cc2db1de2da07a15df17077d728ea74036398fd1e62b6e7e147c53ea944606d751d0934f423b70193ad570a8cba097a823facdc0
-
Filesize
148KB
MD5b8e09161bc02d31d1ae2c99e258144ee
SHA10ccaf9daa161cb90936862f4f8f061afc671c3ca
SHA2566bdf47160d6aa55f0c3f646512107d589f91c0231e95352eff690f5f1fa7b9ad
SHA512489fb5908765d103bc0f3187f3784500acfe9f0f6dce75e4e7d6964576b01efeba2cf83132b95b3f5e84a1ba6dc2b969cdc367a6b9dbe348e52259690c7fed77
-
Filesize
72KB
MD51c7b201413e0761653f61eb45886e00d
SHA1d58ff7e56db798240c5a09b33002bbc9b1b50f60
SHA25616390ac3f6c7783604f5cbdc6f157d358b31956a79d2bbe2bdd60a0632fe65b6
SHA5129ba3d4add08a6501ca0c6dbe84ae3d3907ebc9bcb996e11ffca97e6406ab0999060640a1df7f34db8dc95909c5be8501119c81c83150362b19fd6c50d372f10a
-
Filesize
45KB
MD56d6ff934d61f37f4b292da43125f8fc9
SHA15b56e2404862ef7fe7b42158abe6bb344743792e
SHA256bd06e54c7ce441b88d84bd2ef758017c6740663c0158784e55def171c7986df8
SHA512a135fe5da7b1553a01c752f0162703c9c6428586f349097eb5f7adad722dfb67289e7ff1297a44f321ad7e5cafd2694f5a544291ea660a6daa8cb3fbea8e8e0c
-
Filesize
103KB
MD5d15f3d9213e5972e1e2c069448d6f228
SHA1224f67d7bcb15f1921211d68df19a072dc84ccfe
SHA2569c0e3fcd2615c0a3678e77583970c5d9401ea223db3e517d048453db6427214d
SHA5123e53dde211235f50f7507839f4f0e8ef6c0456f4f92b40e3a9d57eb64c1ee17774698858213e1cdefb8e87803648ff97001b2a00ad2c2c6b0c896774b1e785e3
-
Filesize
85KB
MD544e27b6521dd2c9375f0d1e4737878a3
SHA16a073519fdff88a36bf7837b5636d6814f05255a
SHA2562414245b0355f11217eeed564ecbbd70e362a886982587e968739bc8a24d9290
SHA51201eecad2bb7a2017f77d7df4cc0bf513e15b331108934357db246b9f538f14114cfa31b9c36aac0fca081b57bb9255567517575fb2f613e7eba1b71e59999deb
-
Filesize
145KB
MD5262a039229f90ba2461f2e810ad74447
SHA19dfe5040a3d6ea8262313953c02a1e6ae39c6916
SHA256e20729c3095a40a637efb304bdf57902cd4948f22406138e0dbdf28f034cedb3
SHA512d7612cdbc38aea73462aa7851ab3078dfb89a1b4c96414f5d8144c456f694971f08a79bbb1a738ffeb273f99122432b1009cbf4bd483884dd50ca115a64ef641
-
Filesize
152KB
MD572e9d71fe7ad21610b846614566d6e2f
SHA135071ef247823ff6fa675449c6506caa2f5b145f
SHA2564dc0b35a38321c71c24289acf43c102e6aa875307f830900d39f25491c83cda9
SHA51214431710838e2eea0fdb3a7b73743b6d101ec6a4ceebdf0716e2855e845bd2b1722e5178d310a24ce7e5754076a9dc0e62f351c1518c391c6db8533af35203f3
-
Filesize
176KB
MD5dbadc5fadb7497f5761537c06026ff47
SHA1c8bd7319e170bd5966a73bae6f34cee4782b4f97
SHA256b8fdc5c5f8aa378ef3ba8ee5172550a8f7ca295bebe858dab8ec171f1328036e
SHA5127bced6bbdeb0f770d78f199d16d8ed86e90794141df101d1bb4878c55313af058a5551e0df2da65f6cd3507185cca13c7459aabf97c22faa83518b53321c2b7e
-
Filesize
152KB
MD52aa64c61b9e9b5549381bca685d8330e
SHA171a9c89bda77874d5b6c3d09c89ad7fa5e447725
SHA256c873b45875b1c894b9b5b2cf16b7ff85f065373b87ee5c498ffbfe14d2f620c8
SHA512420e2be6f20065699999ee42533b97915166203899df4ebafdb26d3814f12598a4d3a77099851d265d2c4534e2ec6f14e04cb688a86286e200e0411870c7ad5b