Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 02:42

General

  • Target

    a2c1b716d20b61bc4c57748e1ec195fbac2c5b143cf960d0ffee895160d4b0db.exe

  • Size

    1.0MB

  • MD5

    bef5602089e49d7df0c2544b887d1e04

  • SHA1

    cfa99519b6fa66ce8952c205361cf8e2b53b415a

  • SHA256

    a2c1b716d20b61bc4c57748e1ec195fbac2c5b143cf960d0ffee895160d4b0db

  • SHA512

    2726f63e7298dbb80a069253ba8645fb527a3c4ae5ff4a02a2a7e3319d5b2f81e5c06c6ea7b18a01bdb6e69251df487610bb2db68adab7e6533e15252ffcf342

  • SSDEEP

    24576:+PF6DSSEvVi8ds05OTOfYIOBRaR6URr0GDp6erPEM:+PazuAOfh4RaR6URrNpp

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Users\Admin\AppData\Local\Temp\a2c1b716d20b61bc4c57748e1ec195fbac2c5b143cf960d0ffee895160d4b0db.exe
      "C:\Users\Admin\AppData\Local\Temp\a2c1b716d20b61bc4c57748e1ec195fbac2c5b143cf960d0ffee895160d4b0db.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c mkdir "\\?\C:\Windows "
        3⤵
          PID:3432
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c mkdir "\\?\C:\Windows \System32"
          3⤵
            PID:3000
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "C:\Windows \System32\8469161.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2744
            • C:\Windows \System32\8469161.exe
              "C:\Windows \System32\8469161.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3852
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3540
                • C:\Windows\system32\cmd.exe
                  cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:384
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                    7⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3200
          • C:\Windows\SysWOW64\extrac32.exe
            C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\a2c1b716d20b61bc4c57748e1ec195fbac2c5b143cf960d0ffee895160d4b0db.exe C:\\Users\\Public\\Libraries\\Doteqxzz.PIF
            3⤵
              PID:1324
            • C:\Windows\SysWOW64\SndVol.exe
              C:\Windows\System32\SndVol.exe
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:3272
          • C:\Windows\SysWOW64\sxstrace.exe
            "C:\Windows\SysWOW64\sxstrace.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3608
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:800

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_srnd11oe.4cz.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Windows \System32\8469161.exe

                  Filesize

                  128KB

                  MD5

                  231ce1e1d7d98b44371ffff407d68b59

                  SHA1

                  25510d0f6353dbf0c9f72fc880de7585e34b28ff

                  SHA256

                  30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

                  SHA512

                  520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

                • C:\Windows \System32\netutils.dll

                  Filesize

                  112KB

                  MD5

                  fa7aa88417d0c48807144a1a48fe3fbc

                  SHA1

                  6f5ec990b12d4a6075050a94e0d68d03781fa46d

                  SHA256

                  2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

                  SHA512

                  99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

                • C:\windows \system32\KDECO.bat

                  Filesize

                  11KB

                  MD5

                  c545650595b479c81ad6b9d8882aae39

                  SHA1

                  7a98aa2e6eee23b3c1bba876955d525bc618b3f0

                  SHA256

                  a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9

                  SHA512

                  85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

                • memory/800-62-0x00000293E9E20000-0x00000293E9F28000-memory.dmp

                  Filesize

                  1.0MB

                • memory/1596-4-0x0000000000400000-0x000000000050F000-memory.dmp

                  Filesize

                  1.1MB

                • memory/1596-0-0x0000000002440000-0x0000000002441000-memory.dmp

                  Filesize

                  4KB

                • memory/1596-2-0x0000000004050000-0x0000000005050000-memory.dmp

                  Filesize

                  16.0MB

                • memory/1596-1-0x0000000004050000-0x0000000005050000-memory.dmp

                  Filesize

                  16.0MB

                • memory/1596-38-0x0000000002440000-0x0000000002441000-memory.dmp

                  Filesize

                  4KB

                • memory/3200-22-0x000002423E5A0000-0x000002423E5C2000-memory.dmp

                  Filesize

                  136KB

                • memory/3200-27-0x00007FF9F4E90000-0x00007FF9F5951000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3200-28-0x000002423E650000-0x000002423E660000-memory.dmp

                  Filesize

                  64KB

                • memory/3200-29-0x000002423E650000-0x000002423E660000-memory.dmp

                  Filesize

                  64KB

                • memory/3200-32-0x00007FF9F4E90000-0x00007FF9F5951000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3272-41-0x0000000000C00000-0x0000000001C00000-memory.dmp

                  Filesize

                  16.0MB

                • memory/3272-42-0x0000000000C00000-0x0000000001C00000-memory.dmp

                  Filesize

                  16.0MB

                • memory/3272-43-0x00000000188E0000-0x00000000188FD000-memory.dmp

                  Filesize

                  116KB

                • memory/3272-47-0x0000000000C00000-0x0000000001C00000-memory.dmp

                  Filesize

                  16.0MB

                • memory/3272-40-0x000000001A800000-0x000000001AB4A000-memory.dmp

                  Filesize

                  3.3MB

                • memory/3472-51-0x000000000AFC0000-0x000000000B378000-memory.dmp

                  Filesize

                  3.7MB

                • memory/3472-44-0x000000000AFC0000-0x000000000B378000-memory.dmp

                  Filesize

                  3.7MB

                • memory/3472-63-0x0000000008EA0000-0x0000000008FAF000-memory.dmp

                  Filesize

                  1.1MB

                • memory/3472-54-0x0000000008EA0000-0x0000000008FAF000-memory.dmp

                  Filesize

                  1.1MB

                • memory/3472-55-0x0000000008EA0000-0x0000000008FAF000-memory.dmp

                  Filesize

                  1.1MB

                • memory/3608-49-0x00000000008B0000-0x00000000008F0000-memory.dmp

                  Filesize

                  256KB

                • memory/3608-50-0x0000000002890000-0x000000000292C000-memory.dmp

                  Filesize

                  624KB

                • memory/3608-52-0x00000000008B0000-0x00000000008F0000-memory.dmp

                  Filesize

                  256KB

                • memory/3608-53-0x0000000002890000-0x000000000292C000-memory.dmp

                  Filesize

                  624KB

                • memory/3608-48-0x0000000002A20000-0x0000000002D6A000-memory.dmp

                  Filesize

                  3.3MB

                • memory/3608-46-0x00000000008B0000-0x00000000008F0000-memory.dmp

                  Filesize

                  256KB

                • memory/3608-45-0x00000000008B0000-0x00000000008F0000-memory.dmp

                  Filesize

                  256KB

                • memory/3852-15-0x00000000613C0000-0x00000000613E3000-memory.dmp

                  Filesize

                  140KB