Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 10:48
Static task
static1
Behavioral task
behavioral1
Sample
2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe
Resource
win10v2004-20240508-en
General
-
Target
2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe
-
Size
1.3MB
-
MD5
c2cf4912b15897bbc710cf0fefe1c135
-
SHA1
6dabbb0bd4622068452f148253f6dafd309a15f7
-
SHA256
2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3
-
SHA512
caa62e4252b1aa26ba9946e29d12d48eb938fc904f432d11bcfb991a8ebd22b37e8d94ef9600849f732bd4f996e68fc9473b4cdc6c945920c51e9f6c1a01c99c
-
SSDEEP
24576:AP+g7Wy3xfMZKdcKtTjbJ44EEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKKKKKKKKK7:A/iy3g6TjbrEEEEEEEEEEEEEEEEEEEE+
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3060-8-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 behavioral2/memory/3060-11-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
gbjxxcdX.pifpid process 3060 gbjxxcdX.pif -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xdcxxjbg = "C:\\Users\\Public\\Xdcxxjbg.url" 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exedescription pid process target process PID 4564 set thread context of 3060 4564 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe gbjxxcdX.pif -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 33 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 35 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
gbjxxcdX.pifpid process 3060 gbjxxcdX.pif 3060 gbjxxcdX.pif -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
gbjxxcdX.pifdescription pid process Token: SeDebugPrivilege 3060 gbjxxcdX.pif -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exedescription pid process target process PID 4564 wrote to memory of 4524 4564 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe extrac32.exe PID 4564 wrote to memory of 4524 4564 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe extrac32.exe PID 4564 wrote to memory of 4524 4564 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe extrac32.exe PID 4564 wrote to memory of 3060 4564 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe gbjxxcdX.pif PID 4564 wrote to memory of 3060 4564 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe gbjxxcdX.pif PID 4564 wrote to memory of 3060 4564 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe gbjxxcdX.pif PID 4564 wrote to memory of 3060 4564 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe gbjxxcdX.pif PID 4564 wrote to memory of 3060 4564 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe gbjxxcdX.pif
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe"C:\Users\Admin\AppData\Local\Temp\2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe C:\\Users\\Public\\Libraries\\Xdcxxjbg.PIF2⤵
-
C:\Users\Public\Libraries\gbjxxcdX.pifC:\Users\Public\Libraries\gbjxxcdX.pif2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Libraries\gbjxxcdX.pifFilesize
66KB
MD5c116d3604ceafe7057d77ff27552c215
SHA1452b14432fb5758b46f2897aeccd89f7c82a727d
SHA2567bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA5129202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
-
memory/3060-8-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3060-11-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3060-13-0x000000007317E000-0x000000007317F000-memory.dmpFilesize
4KB
-
memory/3060-14-0x0000000049870000-0x00000000498CA000-memory.dmpFilesize
360KB
-
memory/3060-17-0x000000004C180000-0x000000004C1DA000-memory.dmpFilesize
360KB
-
memory/3060-16-0x0000000073170000-0x0000000073920000-memory.dmpFilesize
7.7MB
-
memory/3060-18-0x0000000073170000-0x0000000073920000-memory.dmpFilesize
7.7MB
-
memory/3060-15-0x000000004C280000-0x000000004C824000-memory.dmpFilesize
5.6MB
-
memory/3060-19-0x0000000073170000-0x0000000073920000-memory.dmpFilesize
7.7MB
-
memory/3060-23-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-41-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-79-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-77-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-75-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-73-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-71-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-69-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-67-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-65-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-63-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-61-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-59-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-57-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-55-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-53-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-49-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-47-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-45-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-43-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-39-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-37-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-35-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-33-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-31-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-29-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-27-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-25-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-51-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-21-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-20-0x000000004C180000-0x000000004C1D3000-memory.dmpFilesize
332KB
-
memory/3060-1070-0x000000004C200000-0x000000004C266000-memory.dmpFilesize
408KB
-
memory/3060-1071-0x0000000073170000-0x0000000073920000-memory.dmpFilesize
7.7MB
-
memory/3060-1072-0x000000004D190000-0x000000004D1E0000-memory.dmpFilesize
320KB
-
memory/3060-1073-0x000000004D1E0000-0x000000004D27C000-memory.dmpFilesize
624KB
-
memory/3060-1076-0x000000007317E000-0x000000007317F000-memory.dmpFilesize
4KB
-
memory/3060-1077-0x0000000073170000-0x0000000073920000-memory.dmpFilesize
7.7MB
-
memory/3060-1078-0x000000004D680000-0x000000004D712000-memory.dmpFilesize
584KB
-
memory/3060-1079-0x000000004D890000-0x000000004D89A000-memory.dmpFilesize
40KB
-
memory/4564-0-0x0000000000740000-0x0000000000741000-memory.dmpFilesize
4KB
-
memory/4564-12-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB