Analysis
-
max time kernel
55s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 16:24
Static task
static1
Behavioral task
behavioral1
Sample
URGENTE_NOTIFICATION.cmd
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
URGENTE_NOTIFICATION.cmd
Resource
win10v2004-20240419-en
General
-
Target
URGENTE_NOTIFICATION.cmd
-
Size
4.3MB
-
MD5
10dfd3dccfeaeb1e19e586e5d89ef1c6
-
SHA1
af3aa6b4249a27778de9e8b2fc2ee6badb0e299a
-
SHA256
f81c9ad169f7dcfa4545eab3552115156d7923957c1cffc4809a574209599e3c
-
SHA512
f8b3d6cc712792f1fa567ecf730809c4b49241e6b5fb31961bf8643a2b7a0af3635672cee0d2ac8e02312c1727ec3c01abb7e35ce49a831865d6a16b66b5ce7e
-
SSDEEP
49152:EEi0F7JFavH5JDy0oqMaKcCln2UE+ESPTcexrEPdOgSlxHgamuc6slj:e
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2492-29-0x0000000002840000-0x0000000003840000-memory.dmp modiloader_stage2 -
Executes dropped EXE 8 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exepid process 984 alpha.exe 3736 alpha.exe 3620 kn.exe 5076 alpha.exe 408 kn.exe 2492 sppsvc.pif 1600 alpha.exe 5108 alpha.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exedescription pid process target process PID 3380 wrote to memory of 232 3380 cmd.exe extrac32.exe PID 3380 wrote to memory of 232 3380 cmd.exe extrac32.exe PID 3380 wrote to memory of 984 3380 cmd.exe alpha.exe PID 3380 wrote to memory of 984 3380 cmd.exe alpha.exe PID 984 wrote to memory of 4428 984 alpha.exe extrac32.exe PID 984 wrote to memory of 4428 984 alpha.exe extrac32.exe PID 3380 wrote to memory of 3736 3380 cmd.exe alpha.exe PID 3380 wrote to memory of 3736 3380 cmd.exe alpha.exe PID 3736 wrote to memory of 3620 3736 alpha.exe kn.exe PID 3736 wrote to memory of 3620 3736 alpha.exe kn.exe PID 3380 wrote to memory of 5076 3380 cmd.exe alpha.exe PID 3380 wrote to memory of 5076 3380 cmd.exe alpha.exe PID 5076 wrote to memory of 408 5076 alpha.exe kn.exe PID 5076 wrote to memory of 408 5076 alpha.exe kn.exe PID 3380 wrote to memory of 2492 3380 cmd.exe sppsvc.pif PID 3380 wrote to memory of 2492 3380 cmd.exe sppsvc.pif PID 3380 wrote to memory of 2492 3380 cmd.exe sppsvc.pif PID 3380 wrote to memory of 1600 3380 cmd.exe alpha.exe PID 3380 wrote to memory of 1600 3380 cmd.exe alpha.exe PID 3380 wrote to memory of 5108 3380 cmd.exe alpha.exe PID 3380 wrote to memory of 5108 3380 cmd.exe alpha.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe2⤵PID:232
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\system32\extrac32.exeextrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵PID:4428
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 92⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 93⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 122⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 123⤵
- Executes dropped EXE
PID:408 -
C:\Users\Public\Libraries\sppsvc.pifC:\Users\Public\Libraries\sppsvc.pif2⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S2⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:5108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Libraries\sppsvc.pifFilesize
1.6MB
MD538310fb63bad19820d761c97f325896d
SHA1ca71e8fd075089fa127281b972d99948e2a562e6
SHA256b8d21812baeb9054f45b0d7544a6ec25029da4d733776aac865f9ce6616fcb07
SHA51244777aa52a467edcb405c311c1bf29f53bbf1fbf875c842ee8fcc6adbfb487087613ede7265391620850d7f4b69864ca7aae9fa1f1d342bbd8658fcae04d0ad8
-
C:\Users\Public\alpha.exeFilesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
C:\Users\Public\kn.exeFilesize
1.6MB
MD5bd8d9943a9b1def98eb83e0fa48796c2
SHA170e89852f023ab7cde0173eda1208dbb580f1e4f
SHA2568de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA51295630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b
-
C:\Users\Public\sppsvc.rtfFilesize
3.1MB
MD5c9b027dae62c2ed28886445584817521
SHA1f82fb286b3662aedd5f9cc7e62945444eb9fcfe7
SHA2569cb3033e5e81cbea5c1638b2f6c922dc379fe1089a1e3a84cbc40a39f7e414cb
SHA512bec913cad1109048c14f182c9ce0720340ffafdea2c6d84d5b676122656b494270dcc3049b6f2833275ccbb6a0009b17efa416114d402251271d991e58c5a44f
-
memory/2492-28-0x0000000002840000-0x0000000003840000-memory.dmpFilesize
16.0MB
-
memory/2492-29-0x0000000002840000-0x0000000003840000-memory.dmpFilesize
16.0MB
-
memory/2492-31-0x0000000000400000-0x000000000059C000-memory.dmpFilesize
1.6MB