Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 18:17

General

  • Target

    8d049e05cbfa3edea467e0612ff157a0.exe

  • Size

    305KB

  • MD5

    8d049e05cbfa3edea467e0612ff157a0

  • SHA1

    777d99db19aed53760dd190497f5468eb8f79da1

  • SHA256

    bac1e7a449c7cc1c55e271229d0a127e783ca811dafe797106053ce8d81c79db

  • SHA512

    524243b8477563fe0ec43b1f29cc0cfe3eeb160d1537d145e33cfb362b08c364a275a371a5f8526f9f94e8a042971f7a5a47b94b3877d59d7618f317513310cc

  • SSDEEP

    6144:Na0cpYqEKpmwKLW9mA73b2wHtzLEU9fTYhg:zbqEKpBKezptzLzfTug

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d049e05cbfa3edea467e0612ff157a0.exe
    "C:\Users\Admin\AppData\Local\Temp\8d049e05cbfa3edea467e0612ff157a0.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Program Files\explorer.bat
      "C:\Program Files\explorer.bat"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\program files\internet explorer\IEXPLORE.EXE
        "C:\program files\internet explorer\IEXPLORE.EXE"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5088 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3704
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files\SxDel.bat""
      2⤵
        PID:1432

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\SxDel.bat

            Filesize

            184B

            MD5

            8f4505e5ddd5c6c6582f1dce7e5a423b

            SHA1

            2f66629e8890db1d3bfb9bbad813068cbb961a70

            SHA256

            64209765a71b7d7f2bce86cd5b0c9888676cc5b2e3ab42f079679ba8109f19c3

            SHA512

            98b4202d7c650dbb2c73cd2b81d7dea441bbaefe8d52ff6c78bb0b3b30f9146a812155edeb02b9605a02ad9a4a58421784f2c285a013a6546a36e3eb4d4bfd02

          • C:\Program Files\explorer.bat

            Filesize

            305KB

            MD5

            8d049e05cbfa3edea467e0612ff157a0

            SHA1

            777d99db19aed53760dd190497f5468eb8f79da1

            SHA256

            bac1e7a449c7cc1c55e271229d0a127e783ca811dafe797106053ce8d81c79db

            SHA512

            524243b8477563fe0ec43b1f29cc0cfe3eeb160d1537d145e33cfb362b08c364a275a371a5f8526f9f94e8a042971f7a5a47b94b3877d59d7618f317513310cc

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            471B

            MD5

            52bfc02b370f1b48b834ce1c58ad6560

            SHA1

            d3dbca3ed04caabf69ec8d525a83cde0919809cf

            SHA256

            fce02a7cb2ed194e21949d8a394e69f1dd30c4c517addc831018b8a0b7235a97

            SHA512

            5fb4c1b2d4173f5de1237e2fd55b9081b99756217d5d639da3e0e1bbe339d87be2e9b732ef783446bdedee2af8730e4bedb3184d58ba0bce0881ddc199495289

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            404B

            MD5

            255c110ca278e83017a4cf143fbc0fd8

            SHA1

            64defbc1ded163f74fe1c7662500bc6da5f95f3c

            SHA256

            e0bc07da47dd34027a97c22199618a1c9ccac037b5bcced0b73b95a0300e8cac

            SHA512

            7e2e4c4cacfa581205568362652192fd48ab676eb1e6776088230ba5042416b30ef2685dd9731b4d51efd792d71f7dcc5a8fb684b61ba385f8068e32290995f0

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV2I56HE\suggestions[1].en-US

            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          • memory/1052-10-0x00000000005F0000-0x00000000005F1000-memory.dmp

            Filesize

            4KB

          • memory/1052-14-0x0000000000400000-0x0000000000553210-memory.dmp

            Filesize

            1.3MB

          • memory/1052-9-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/1052-8-0x0000000000400000-0x0000000000553210-memory.dmp

            Filesize

            1.3MB

          • memory/2464-0-0x0000000000400000-0x0000000000553210-memory.dmp

            Filesize

            1.3MB

          • memory/2464-15-0x0000000000400000-0x0000000000553210-memory.dmp

            Filesize

            1.3MB

          • memory/2464-2-0x0000000000710000-0x0000000000711000-memory.dmp

            Filesize

            4KB

          • memory/2464-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/5088-11-0x0000000000F50000-0x00000000010A4000-memory.dmp

            Filesize

            1.3MB