Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 01:46
Behavioral task
behavioral1
Sample
a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe
Resource
win10v2004-20240508-en
General
-
Target
a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe
-
Size
204KB
-
MD5
815baa9da59a19abe287cf82b9f74f25
-
SHA1
b12ed48f64e45b41712c53c58a8441899c85465f
-
SHA256
a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a
-
SHA512
17cad0ef7287725771123a1235bedb30c48dd367a237ceb1277556c323718983124f3d13dd93e6a57d8e26936d1aade11a532a5fe7d7adcee29aad1a49633a3e
-
SSDEEP
3072:DOfKQJcinxphkG5Q6GdpIOkJHhKRyOXK:DmKQJ5xEG2NpRbtX
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4528-48-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4528-50-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4528-45-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4528-56-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4528-53-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4528-60-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4528-48-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4528-50-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4528-45-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4528-56-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4528-53-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4528-60-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
UPX dump on OEP (original entry point) 13 IoCs
Processes:
resource yara_rule behavioral2/memory/3512-0-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/1716-9-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/1716-11-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/1716-12-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/3512-13-0x0000000000400000-0x0000000000433000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe UPX behavioral2/memory/4584-39-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4584-40-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4584-41-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4584-54-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4352-55-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/1716-57-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/4352-59-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 4584 Flaseher.exe 4352 Flaseher.exe 4528 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/3512-0-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/1716-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1716-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1716-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3512-13-0x0000000000400000-0x0000000000433000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/4584-39-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4584-40-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4584-41-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4584-54-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4352-55-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1716-57-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4352-59-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exeFlaseher.exedescription pid process target process PID 3512 set thread context of 1716 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe PID 4584 set thread context of 4352 4584 Flaseher.exe Flaseher.exe PID 4584 set thread context of 4528 4584 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe Token: SeDebugPrivilege 4352 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exea2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exeFlaseher.exeFlaseher.exepid process 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe 1716 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe 4584 Flaseher.exe 4352 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exea2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.execmd.exeFlaseher.exedescription pid process target process PID 3512 wrote to memory of 1716 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe PID 3512 wrote to memory of 1716 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe PID 3512 wrote to memory of 1716 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe PID 3512 wrote to memory of 1716 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe PID 3512 wrote to memory of 1716 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe PID 3512 wrote to memory of 1716 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe PID 3512 wrote to memory of 1716 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe PID 3512 wrote to memory of 1716 3512 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe PID 1716 wrote to memory of 2852 1716 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe cmd.exe PID 1716 wrote to memory of 2852 1716 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe cmd.exe PID 1716 wrote to memory of 2852 1716 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe cmd.exe PID 2852 wrote to memory of 1912 2852 cmd.exe reg.exe PID 2852 wrote to memory of 1912 2852 cmd.exe reg.exe PID 2852 wrote to memory of 1912 2852 cmd.exe reg.exe PID 1716 wrote to memory of 4584 1716 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe Flaseher.exe PID 1716 wrote to memory of 4584 1716 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe Flaseher.exe PID 1716 wrote to memory of 4584 1716 a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe Flaseher.exe PID 4584 wrote to memory of 4352 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4352 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4352 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4352 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4352 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4352 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4352 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4352 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe PID 4584 wrote to memory of 4528 4584 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe"C:\Users\Admin\AppData\Local\Temp\a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe"C:\Users\Admin\AppData\Local\Temp\a2c6f847acdd8452413d655dfb929abebffcba8713cf3464e5ba766c7f889b5a.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QVRFR.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
PID:1912 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4352 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
PID:4528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\QVRFR.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
204KB
MD594162ab25f33106149f817955ef170be
SHA1046586941f3be161183295045e6994ee13f8e3bb
SHA256f5d0088e79bd407c96fe458f2c29436b820024e20e195ecde8275f19f263139d
SHA512a5ee31dbb571f8df41ed4e33ca6ff69825e896a6d0a261a0c14ec2cd962a8c10700737e061800ad42d62e4e83676c0ee07822963a0ca2ad5f0f883cd83710d2b
-
memory/1716-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1716-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1716-12-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1716-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3512-7-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/3512-5-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/3512-8-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/3512-6-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/3512-13-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3512-3-0x0000000002A70000-0x0000000002A71000-memory.dmpFilesize
4KB
-
memory/3512-4-0x0000000002AA0000-0x0000000002AA1000-memory.dmpFilesize
4KB
-
memory/3512-0-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4352-55-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4352-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4528-60-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4528-50-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4528-45-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4528-48-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4528-56-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4528-53-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4584-41-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4584-54-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4584-40-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4584-39-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB