Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
Resource
win10v2004-20240508-en
General
-
Target
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
-
Size
1.4MB
-
MD5
0b7e50b40135c3919e58a39b9a224353
-
SHA1
3e2bfa0bec42f913d52b4df5c58dac2d10a80922
-
SHA256
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24
-
SHA512
3aa4e32dce04bcc5d36fecbe722064cee6c4211806414438d34f1a9fb29862dbe022b2890efb64f490a636b5fb38dc17a65192ae29a4830633bfd69ed182708a
-
SSDEEP
24576:yn25nPkW3amy8sQxeWcktTjbJ49auDyEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKr:yn2kGy7wTjbI/DyEEEEEEEEEEEEEEEEm
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
Processes:
resource yara_rule behavioral2/memory/4420-14-0x00000000344B0000-0x000000003450E000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-17-0x0000000034B20000-0x0000000034B7C000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-63-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-65-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-61-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-59-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-57-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-55-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-53-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-51-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-49-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-47-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-43-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-41-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-39-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-37-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-35-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-33-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-31-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-29-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-27-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-25-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-23-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-21-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-20-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-45-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-79-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-77-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-75-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-73-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-71-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-69-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/4420-67-0x0000000034B20000-0x0000000034B76000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4420-8-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 behavioral2/memory/4420-11-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
drohzvuH.pifpid process 4420 drohzvuH.pif -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Huvzhord = "C:\\Users\\Public\\Huvzhord.url" a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exedescription pid process target process PID 4840 set thread context of 4420 4840 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 31 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 34 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
drohzvuH.pifpid process 4420 drohzvuH.pif 4420 drohzvuH.pif 4420 drohzvuH.pif -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
drohzvuH.pifdescription pid process Token: SeDebugPrivilege 4420 drohzvuH.pif -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exedescription pid process target process PID 4840 wrote to memory of 876 4840 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe extrac32.exe PID 4840 wrote to memory of 876 4840 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe extrac32.exe PID 4840 wrote to memory of 876 4840 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe extrac32.exe PID 4840 wrote to memory of 4420 4840 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif PID 4840 wrote to memory of 4420 4840 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif PID 4840 wrote to memory of 4420 4840 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif PID 4840 wrote to memory of 4420 4840 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif PID 4840 wrote to memory of 4420 4840 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif
Processes
-
C:\Users\Admin\AppData\Local\Temp\a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe"C:\Users\Admin\AppData\Local\Temp\a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe C:\\Users\\Public\\Libraries\\Huvzhord.PIF2⤵PID:876
-
C:\Users\Public\Libraries\drohzvuH.pifC:\Users\Public\Libraries\drohzvuH.pif2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Libraries\drohzvuH.pifFilesize
66KB
MD5c116d3604ceafe7057d77ff27552c215
SHA1452b14432fb5758b46f2897aeccd89f7c82a727d
SHA2567bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA5129202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
-
memory/4420-8-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4420-11-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4420-13-0x00000000743FE000-0x00000000743FF000-memory.dmpFilesize
4KB
-
memory/4420-14-0x00000000344B0000-0x000000003450E000-memory.dmpFilesize
376KB
-
memory/4420-15-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/4420-16-0x0000000034570000-0x0000000034B14000-memory.dmpFilesize
5.6MB
-
memory/4420-17-0x0000000034B20000-0x0000000034B7C000-memory.dmpFilesize
368KB
-
memory/4420-18-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/4420-63-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-65-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-61-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-59-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-57-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-55-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-53-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-51-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-49-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-47-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-43-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-41-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-39-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-37-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-35-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-33-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-31-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-29-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-27-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-25-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-23-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-21-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-20-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-45-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-19-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/4420-79-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-77-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-75-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-73-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-71-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-69-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-67-0x0000000034B20000-0x0000000034B76000-memory.dmpFilesize
344KB
-
memory/4420-1158-0x0000000034C80000-0x0000000034CE6000-memory.dmpFilesize
408KB
-
memory/4420-1159-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/4420-1160-0x0000000035540000-0x0000000035590000-memory.dmpFilesize
320KB
-
memory/4420-1161-0x0000000035590000-0x000000003562C000-memory.dmpFilesize
624KB
-
memory/4420-1163-0x0000000035EF0000-0x0000000035F82000-memory.dmpFilesize
584KB
-
memory/4420-1164-0x0000000036100000-0x000000003610A000-memory.dmpFilesize
40KB
-
memory/4420-1166-0x00000000743FE000-0x00000000743FF000-memory.dmpFilesize
4KB
-
memory/4420-1167-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/4840-0-0x0000000002470000-0x0000000002471000-memory.dmpFilesize
4KB
-
memory/4840-12-0x0000000000400000-0x0000000000578000-memory.dmpFilesize
1.5MB