Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 05:41
Static task
static1
Behavioral task
behavioral1
Sample
fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe
Resource
win10v2004-20240426-en
General
-
Target
fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe
-
Size
308KB
-
MD5
4f495d696694e5d074125e7b95180f6c
-
SHA1
c390cd7665fc9eb63f751179598f324bb79dd32a
-
SHA256
fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3
-
SHA512
d62e64723321c1af1ebb7bc327fc84578ddf59373204aa8ed22b91533a92b8de949196609137bc48432c4a9f217a3b12123ee72785384196846d0de271f4f252
-
SSDEEP
3072:/c3sBG7mXh7m/zZM3jAbNOM6CNtDCZFL:E3sBz0Z4Mj72F
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
Processes:
resource yara_rule behavioral1/memory/101488-147851-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/101488-147851-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
UPX dump on OEP (original entry point) 10 IoCs
Processes:
resource yara_rule behavioral1/memory/153596-73920-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/153596-73923-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/153596-73924-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/153596-73925-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/153596-111941-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/101488-147835-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral1/memory/101580-147834-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/153596-147845-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/101580-147850-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/101488-147851-0x0000000000400000-0x0000000000414000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 62524 csrsll.exe 101580 csrsll.exe 101488 csrsll.exe -
Loads dropped DLL 5 IoCs
Processes:
fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exepid process 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe -
Processes:
resource yara_rule behavioral1/memory/153596-73920-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/153596-73918-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/153596-73923-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/153596-73924-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/153596-73925-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/153596-111941-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/101488-147835-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/101580-147834-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/153596-147845-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/101580-147850-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/101488-147851-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.execsrsll.exedescription pid process target process PID 2364 set thread context of 153596 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe PID 62524 set thread context of 101580 62524 csrsll.exe csrsll.exe PID 62524 set thread context of 101488 62524 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe Token: SeDebugPrivilege 101580 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exefc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.execsrsll.execsrsll.exepid process 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe 62524 csrsll.exe 101580 csrsll.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exefc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.execmd.execsrsll.exedescription pid process target process PID 2364 wrote to memory of 153596 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe PID 2364 wrote to memory of 153596 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe PID 2364 wrote to memory of 153596 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe PID 2364 wrote to memory of 153596 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe PID 2364 wrote to memory of 153596 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe PID 2364 wrote to memory of 153596 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe PID 2364 wrote to memory of 153596 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe PID 2364 wrote to memory of 153596 2364 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe PID 153596 wrote to memory of 7156 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe cmd.exe PID 153596 wrote to memory of 7156 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe cmd.exe PID 153596 wrote to memory of 7156 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe cmd.exe PID 153596 wrote to memory of 7156 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe cmd.exe PID 7156 wrote to memory of 62480 7156 cmd.exe reg.exe PID 7156 wrote to memory of 62480 7156 cmd.exe reg.exe PID 7156 wrote to memory of 62480 7156 cmd.exe reg.exe PID 7156 wrote to memory of 62480 7156 cmd.exe reg.exe PID 153596 wrote to memory of 62524 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe csrsll.exe PID 153596 wrote to memory of 62524 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe csrsll.exe PID 153596 wrote to memory of 62524 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe csrsll.exe PID 153596 wrote to memory of 62524 153596 fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe csrsll.exe PID 62524 wrote to memory of 101580 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101580 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101580 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101580 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101580 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101580 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101580 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101580 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101488 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101488 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101488 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101488 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101488 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101488 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101488 62524 csrsll.exe csrsll.exe PID 62524 wrote to memory of 101488 62524 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe"C:\Users\Admin\AppData\Local\Temp\fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe"C:\Users\Admin\AppData\Local\Temp\fc55c1c684b552734e49e0787964cdff9daeff2270dc05a09d7ce6994cdc66f3.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PLKXE.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PLKXE.batFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
308KB
MD5c27b5c626c70ddec4b8d49bfa1e9e867
SHA1898182f0172a0223680c1a036401b62275d72eab
SHA256a1d00a8d57dabbcee263695264a8c5f7b007c9c0ed9607a82e1d7d40e9924377
SHA512dd8dd932bbf688a569c7ba1d2c366d225d4cb7581737434d3afa4a3c8e299fe9bea9890e5319fe60f0b55d0cb50ba40ee02cb90733d6dedc2b6505de5e4ca628
-
memory/2364-3-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2364-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/62524-73965-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/101488-147851-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/101488-147835-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/101580-147850-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/101580-147834-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/153596-73925-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/153596-73924-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/153596-73923-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/153596-111941-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/153596-73922-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/153596-73916-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/153596-147845-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/153596-73918-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/153596-73920-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB