Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 22:27
Behavioral task
behavioral1
Sample
6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe
Resource
win7-20231129-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe
- Size 90KB
- Sample240509-2db2tsaa8z
- SHA256 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6
- MD5 98a6edb049854d7c4f820281ca70e3b6
- SHA1 a47c5a32fd519c05b1ecc8d826a217be64a09620
- SHA512 d6b5e5d30c9bd6f1a45c9ad806d4a2df9e90ce8ef9a9e32ca498946f842d9095734a3c4951f156851347537526262b5f85e254846304e858056ec47e2744659f
- SSDEEP 1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Detects Windows executables referencing non-Windows User-Agents 4 IoCs
resource yara_rule behavioral2/memory/2476-54-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2476-53-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2476-51-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2476-60-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral2/memory/2476-54-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2476-53-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2476-51-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2476-60-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 - UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral2/memory/3400-0-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/2848-3-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/2848-13-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/3400-12-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/2848-9-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0008000000022ac3-29.dat UPX behavioral2/memory/5072-37-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/5072-48-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/1692-55-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/2476-54-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/2476-53-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/2476-51-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/2476-49-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/2476-43-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/2848-58-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/1692-59-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/2476-60-0x0000000000400000-0x0000000000414000-memory.dmp UPX - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe - Executes dropped EXE 3 IoCs
pid Process 5072 csrsll.exe 1692 csrsll.exe 2476 csrsll.exe -
resource yara_rule behavioral2/memory/3400-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2848-3-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2848-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3400-12-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2848-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3400-5-0x0000000002910000-0x0000000002912000-memory.dmp upx behavioral2/files/0x0008000000022ac3-29.dat upx behavioral2/memory/5072-37-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/5072-48-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1692-55-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2476-54-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2476-53-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2476-51-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2476-49-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2476-43-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2848-58-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1692-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2476-60-0x0000000000400000-0x0000000000414000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3400 set thread context of 2848 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 88 PID 5072 set thread context of 1692 5072 csrsll.exe 94 PID 5072 set thread context of 2476 5072 csrsll.exe 95 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe Token: SeDebugPrivilege 1692 csrsll.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 2848 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 5072 csrsll.exe 1692 csrsll.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3400 wrote to memory of 2848 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 88 PID 3400 wrote to memory of 2848 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 88 PID 3400 wrote to memory of 2848 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 88 PID 3400 wrote to memory of 2848 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 88 PID 3400 wrote to memory of 2848 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 88 PID 3400 wrote to memory of 2848 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 88 PID 3400 wrote to memory of 2848 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 88 PID 3400 wrote to memory of 2848 3400 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 88 PID 2848 wrote to memory of 3720 2848 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 89 PID 2848 wrote to memory of 3720 2848 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 89 PID 2848 wrote to memory of 3720 2848 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 89 PID 3720 wrote to memory of 4996 3720 cmd.exe 92 PID 3720 wrote to memory of 4996 3720 cmd.exe 92 PID 3720 wrote to memory of 4996 3720 cmd.exe 92 PID 2848 wrote to memory of 5072 2848 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 93 PID 2848 wrote to memory of 5072 2848 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 93 PID 2848 wrote to memory of 5072 2848 6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe 93 PID 5072 wrote to memory of 1692 5072 csrsll.exe 94 PID 5072 wrote to memory of 1692 5072 csrsll.exe 94 PID 5072 wrote to memory of 1692 5072 csrsll.exe 94 PID 5072 wrote to memory of 1692 5072 csrsll.exe 94 PID 5072 wrote to memory of 1692 5072 csrsll.exe 94 PID 5072 wrote to memory of 1692 5072 csrsll.exe 94 PID 5072 wrote to memory of 1692 5072 csrsll.exe 94 PID 5072 wrote to memory of 1692 5072 csrsll.exe 94 PID 5072 wrote to memory of 2476 5072 csrsll.exe 95 PID 5072 wrote to memory of 2476 5072 csrsll.exe 95 PID 5072 wrote to memory of 2476 5072 csrsll.exe 95 PID 5072 wrote to memory of 2476 5072 csrsll.exe 95 PID 5072 wrote to memory of 2476 5072 csrsll.exe 95 PID 5072 wrote to memory of 2476 5072 csrsll.exe 95 PID 5072 wrote to memory of 2476 5072 csrsll.exe 95 PID 5072 wrote to memory of 2476 5072 csrsll.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe"C:\Users\Admin\AppData\Local\Temp\6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe"C:\Users\Admin\AppData\Local\Temp\6897cb8ea56b896173166e10cf6d5806e54ff984092d9ea1c53746298fde07b6.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PQNVH.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
PID:4996
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
PID:2476
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\PQNVH.txt
- Size 145B
- SHA256 08375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
- MD5 4eb61ec7816c34ec8c125acadc57ec1b
- SHA1 b0015cc865c0bb1a027be663027d3829401a31cc
- SHA512 f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
- Size 90KB
- SHA256 3cd0ceca4af6bf7cc102a55f4f1f5e1d74b570161627206a196d1e35c429f113
- MD5 66e64bd65866d8cdc35c1fd18f8f1918
- SHA1 4550236b40c2724df0bd2f84e4033a5fd2d39d37
- SHA512 ebab2bcb409f62fa349f9806b1bc4912d6e2bd307be1c275deb0d7a0148603c1c02be9b2e36e51e15fda03e818d664955162e8474ed4ea0a11c1964e2aba4440
- SSDEEP 1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
- MD5 SHA1 SHA512 SSDEEP