Analysis
-
max time kernel
114s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 15:48
Static task
static1
Behavioral task
behavioral1
Sample
cfe49535d5614bead6b98f51a064bb90_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cfe49535d5614bead6b98f51a064bb90_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
cfe49535d5614bead6b98f51a064bb90_NEAS.exe
-
Size
112KB
-
MD5
cfe49535d5614bead6b98f51a064bb90
-
SHA1
d8741fee49ed44ef8ea0a84bcde1ffbb6efe689a
-
SHA256
d1d7b0e5a318fa830b20ba086db896bdd95b390329ab1781b8663c499b397e9e
-
SHA512
05fdfe07b6f492a9564ec6c3c48c9eb14e68d86b0bd3148791c0600070ed18a8f71e864f220c2e51adbe21096ff437729b6192c40a185e7adbc2cdcb090b34a4
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2976-64-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2976-63-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2976-62-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2976-68-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cfe49535d5614bead6b98f51a064bb90_NEAS.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation cfe49535d5614bead6b98f51a064bb90_NEAS.exe -
Executes dropped EXE 3 IoCs
Processes:
WAMain.exeWAMain.exeWAMain.exepid process 1384 WAMain.exe 3348 WAMain.exe 2976 WAMain.exe -
Processes:
resource yara_rule behavioral2/memory/1788-20-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1788-18-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1788-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2976-56-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2976-64-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2976-63-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2976-61-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2976-62-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1788-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2976-68-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3348-67-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
cfe49535d5614bead6b98f51a064bb90_NEAS.exeWAMain.exedescription pid process target process PID 224 set thread context of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 set thread context of 1788 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 1384 set thread context of 1020 1384 WAMain.exe svchost.exe PID 1384 set thread context of 3348 1384 WAMain.exe WAMain.exe PID 1384 set thread context of 2976 1384 WAMain.exe WAMain.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1820 1020 WerFault.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe 5092 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WAMain.exedescription pid process Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe Token: SeDebugPrivilege 3348 WAMain.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
cfe49535d5614bead6b98f51a064bb90_NEAS.exesvchost.execfe49535d5614bead6b98f51a064bb90_NEAS.exeWAMain.exeWAMain.exepid process 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe 5092 svchost.exe 1788 cfe49535d5614bead6b98f51a064bb90_NEAS.exe 1384 WAMain.exe 3348 WAMain.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
cfe49535d5614bead6b98f51a064bb90_NEAS.execfe49535d5614bead6b98f51a064bb90_NEAS.execmd.exeWAMain.exedescription pid process target process PID 224 wrote to memory of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 wrote to memory of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 wrote to memory of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 wrote to memory of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 wrote to memory of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 wrote to memory of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 wrote to memory of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 wrote to memory of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 wrote to memory of 5092 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 224 wrote to memory of 1788 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 224 wrote to memory of 1788 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 224 wrote to memory of 1788 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 224 wrote to memory of 1788 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 224 wrote to memory of 1788 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 224 wrote to memory of 1788 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 224 wrote to memory of 1788 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 224 wrote to memory of 1788 224 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 1788 wrote to memory of 2636 1788 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cmd.exe PID 1788 wrote to memory of 2636 1788 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cmd.exe PID 1788 wrote to memory of 2636 1788 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cmd.exe PID 2636 wrote to memory of 4924 2636 cmd.exe reg.exe PID 2636 wrote to memory of 4924 2636 cmd.exe reg.exe PID 2636 wrote to memory of 4924 2636 cmd.exe reg.exe PID 1788 wrote to memory of 1384 1788 cfe49535d5614bead6b98f51a064bb90_NEAS.exe WAMain.exe PID 1788 wrote to memory of 1384 1788 cfe49535d5614bead6b98f51a064bb90_NEAS.exe WAMain.exe PID 1788 wrote to memory of 1384 1788 cfe49535d5614bead6b98f51a064bb90_NEAS.exe WAMain.exe PID 1384 wrote to memory of 1020 1384 WAMain.exe svchost.exe PID 1384 wrote to memory of 1020 1384 WAMain.exe svchost.exe PID 1384 wrote to memory of 1020 1384 WAMain.exe svchost.exe PID 1384 wrote to memory of 1020 1384 WAMain.exe svchost.exe PID 1384 wrote to memory of 3348 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 3348 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 3348 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 3348 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 3348 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 3348 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 3348 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 3348 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 2976 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 2976 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 2976 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 2976 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 2976 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 2976 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 2976 1384 WAMain.exe WAMain.exe PID 1384 wrote to memory of 2976 1384 WAMain.exe WAMain.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BDXTO.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵
- Adds Run key to start application
PID:4924 -
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:1020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 845⤵
- Program crash
PID:1820 -
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3348 -
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
PID:2976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1020 -ip 10201⤵PID:2000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD5cae42607cee55c34b27b8069520ef9e5
SHA1ea0f869ba8490d836d0756f6355253e15923d18a
SHA25617ec7c908f50fb3f567572cdce27fce7ef12a893b3284d8e46cdf42ce5ed3d92
SHA5125da6f58a9d81c693636134029cba977c468a96db19a92278852e69651a78154c3163ee049104ce5c4204c4819e47e0d104deffdb388f936b86ae2d07a41b0f77