Analysis
-
max time kernel
134s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 11:52
Behavioral task
behavioral1
Sample
恋雪系统变速器 1.4 Beta2/lxspeed.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
恋雪系统变速器 1.4 Beta2/lxspeed.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
恋雪系统变速器 1.4 Beta2/恋雪系统变速器 1.4 Beta2.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
恋雪系统变速器 1.4 Beta2/恋雪系统变速器 1.4 Beta2.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
恋雪系统变速器 1.4 Beta2/红豆软件站.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
恋雪系统变速器 1.4 Beta2/红豆软件站.url
Resource
win10v2004-20240419-en
General
-
Target
恋雪系统变速器 1.4 Beta2/恋雪系统变速器 1.4 Beta2.exe
-
Size
2.2MB
-
MD5
ed00bbb91cc136de5b56270fe470f0f6
-
SHA1
b3eac9bd49897ae871a2992368014534a9cd86f0
-
SHA256
1ea21ca8cbf3ca8e964d8a4a93c91eaf83771e2878bd67dc4cb4721774e6a260
-
SHA512
f933d267837ae594852bfc6cf357c11d539cb0b144ecd7d08f582bb0c5c79938ea18433d81480238bb0fc443fc54254212ce2e8a8249fde251adfc7253cb88e5
-
SSDEEP
49152:LXeJczfx+OmM7WNQovKIRZLdhS/bety0vYdqG85HedVm1s8:LXccb4dM7WLKIj8Ct1vcqrYa
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral4/memory/2680-13-0x0000000000400000-0x00000000004BE000-memory.dmp modiloader_stage2 behavioral4/memory/2680-16-0x0000000000400000-0x00000000004BE000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
LianXue_WPE.exeLianXue_WPE.exepid process 1272 LianXue_WPE.exe 2680 LianXue_WPE.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\LianXue_WPE.exe upx behavioral4/memory/1272-11-0x0000000000400000-0x0000000000565000-memory.dmp upx behavioral4/memory/1080-15-0x0000000000EA0000-0x0000000001005000-memory.dmp upx -
Processes:
resource yara_rule behavioral4/memory/1636-0-0x0000000000400000-0x00000000008E7000-memory.dmp vmprotect behavioral4/memory/1636-2-0x0000000000400000-0x00000000008E7000-memory.dmp vmprotect behavioral4/memory/1636-9-0x0000000000400000-0x00000000008E7000-memory.dmp vmprotect behavioral4/memory/1636-5-0x0000000000400000-0x00000000008E7000-memory.dmp vmprotect behavioral4/memory/1636-19-0x0000000000400000-0x00000000008E7000-memory.dmp vmprotect behavioral4/memory/1636-21-0x0000000000400000-0x00000000008E7000-memory.dmp vmprotect behavioral4/memory/1636-23-0x0000000000400000-0x00000000008E7000-memory.dmp vmprotect -
Drops file in System32 directory 1 IoCs
Processes:
LianXue_WPE.exedescription ioc process File created C:\Windows\SysWOW64\2010.txt LianXue_WPE.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
LianXue_WPE.exeLianXue_WPE.exedescription pid process target process PID 1272 set thread context of 2680 1272 LianXue_WPE.exe LianXue_WPE.exe PID 2680 set thread context of 1080 2680 LianXue_WPE.exe IEXPLORE.EXE -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31105141" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31105141" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31105141" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3B16F407-0C68-11EF-9107-6EA7B9857CFA} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "260072852" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "260072852" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "271948009" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421847703" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
恋雪系统变速器 1.4 Beta2.exepid process 1636 恋雪系统变速器 1.4 Beta2.exe 1636 恋雪系统变速器 1.4 Beta2.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1080 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
恋雪系统变速器 1.4 Beta2.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1636 恋雪系统变速器 1.4 Beta2.exe 1636 恋雪系统变速器 1.4 Beta2.exe 1636 恋雪系统变速器 1.4 Beta2.exe 1636 恋雪系统变速器 1.4 Beta2.exe 1080 IEXPLORE.EXE 1080 IEXPLORE.EXE 5036 IEXPLORE.EXE 5036 IEXPLORE.EXE 5036 IEXPLORE.EXE 5036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
恋雪系统变速器 1.4 Beta2.exeLianXue_WPE.exeLianXue_WPE.exeIEXPLORE.EXEdescription pid process target process PID 1636 wrote to memory of 1272 1636 恋雪系统变速器 1.4 Beta2.exe LianXue_WPE.exe PID 1636 wrote to memory of 1272 1636 恋雪系统变速器 1.4 Beta2.exe LianXue_WPE.exe PID 1636 wrote to memory of 1272 1636 恋雪系统变速器 1.4 Beta2.exe LianXue_WPE.exe PID 1272 wrote to memory of 2680 1272 LianXue_WPE.exe LianXue_WPE.exe PID 1272 wrote to memory of 2680 1272 LianXue_WPE.exe LianXue_WPE.exe PID 1272 wrote to memory of 2680 1272 LianXue_WPE.exe LianXue_WPE.exe PID 1272 wrote to memory of 2680 1272 LianXue_WPE.exe LianXue_WPE.exe PID 1272 wrote to memory of 2680 1272 LianXue_WPE.exe LianXue_WPE.exe PID 2680 wrote to memory of 1080 2680 LianXue_WPE.exe IEXPLORE.EXE PID 2680 wrote to memory of 1080 2680 LianXue_WPE.exe IEXPLORE.EXE PID 2680 wrote to memory of 1080 2680 LianXue_WPE.exe IEXPLORE.EXE PID 1080 wrote to memory of 5036 1080 IEXPLORE.EXE IEXPLORE.EXE PID 1080 wrote to memory of 5036 1080 IEXPLORE.EXE IEXPLORE.EXE PID 1080 wrote to memory of 5036 1080 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\恋雪系统变速器 1.4 Beta2\恋雪系统变速器 1.4 Beta2.exe"C:\Users\Admin\AppData\Local\Temp\恋雪系统变速器 1.4 Beta2\恋雪系统变速器 1.4 Beta2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\LianXue_WPE.exeC:\Users\Admin\AppData\Local\Temp\LianXue_WPE.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\LianXue_WPE.exeC:\Users\Admin\AppData\Local\Temp\LianXue_WPE.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5cf184a85bb889ee72130f32f3de611f7
SHA1500de7c317290cd07a6ad8773cdc75623a0549ac
SHA25609f37ae0bf919e075441a0c5d52a18208ed3133c777d78271a1f7fdabef6ab15
SHA512754309fc8b3135cac46adfb778e86c813ecfff3415cdcf5d6530827214f14e079a7a07546df99a518284fbc98e333f16023fc1ca52d8c1877e44cfe558520ccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD50ff508721e75d935173cb66b202771d3
SHA14e99a71bf86157aec7c4d6d4df7a83df1d54ea56
SHA25625a58570398e8138d121fb3b1fc7d3d3f8ba978b30be516fe61a1b87c76b141c
SHA512bcec84033c570c9f053e8d95f7b51fd4ca3b5f0f46848dd23409020e6f4119cfc09d5e77bb90a8686bc03277d1dd99bd74441fdc960253e2df9c6d3c52442769
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
702KB
MD5c7734ebabc26a1989a0f151abe699a18
SHA14bfc5c8f96d220b0b768b266f0ad9a6020644938
SHA2562e6a28f71058d8641fa251a1327ff4f9a7891cb1a7079f1aa3da1713cfcf585b
SHA512e4e6fe6ec0c64ef4357921ed551f7436128e9ce3f86d8a939217023db78351080c09b78d6b0e9d7d6874d807e63ac62a0bc97d2782c673d3ef42a1323c4eb4bf