Analysis
-
max time kernel
144s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:33
Static task
static1
Behavioral task
behavioral1
Sample
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
Resource
win10v2004-20240426-en
General
-
Target
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
-
Size
1.4MB
-
MD5
0b7e50b40135c3919e58a39b9a224353
-
SHA1
3e2bfa0bec42f913d52b4df5c58dac2d10a80922
-
SHA256
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24
-
SHA512
3aa4e32dce04bcc5d36fecbe722064cee6c4211806414438d34f1a9fb29862dbe022b2890efb64f490a636b5fb38dc17a65192ae29a4830633bfd69ed182708a
-
SSDEEP
24576:yn25nPkW3amy8sQxeWcktTjbJ49auDyEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKr:yn2kGy7wTjbI/DyEEEEEEEEEEEEEEEEm
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3548-9-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 behavioral2/memory/3548-12-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
drohzvuH.pifpid process 3548 drohzvuH.pif -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Huvzhord = "C:\\Users\\Public\\Huvzhord.url" a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exedescription pid process target process PID 2780 set thread context of 3548 2780 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 32 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 34 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
drohzvuH.pifpid process 3548 drohzvuH.pif 3548 drohzvuH.pif 3548 drohzvuH.pif -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
drohzvuH.pifdescription pid process Token: SeDebugPrivilege 3548 drohzvuH.pif -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exedescription pid process target process PID 2780 wrote to memory of 5016 2780 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe extrac32.exe PID 2780 wrote to memory of 5016 2780 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe extrac32.exe PID 2780 wrote to memory of 5016 2780 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe extrac32.exe PID 2780 wrote to memory of 3548 2780 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif PID 2780 wrote to memory of 3548 2780 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif PID 2780 wrote to memory of 3548 2780 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif PID 2780 wrote to memory of 3548 2780 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif PID 2780 wrote to memory of 3548 2780 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe drohzvuH.pif
Processes
-
C:\Users\Admin\AppData\Local\Temp\a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe"C:\Users\Admin\AppData\Local\Temp\a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe C:\\Users\\Public\\Libraries\\Huvzhord.PIF2⤵
-
C:\Users\Public\Libraries\drohzvuH.pifC:\Users\Public\Libraries\drohzvuH.pif2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Libraries\drohzvuH.pifFilesize
66KB
MD5c116d3604ceafe7057d77ff27552c215
SHA1452b14432fb5758b46f2897aeccd89f7c82a727d
SHA2567bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA5129202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
-
memory/2780-0-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/2780-1-0x0000000000400000-0x0000000000578000-memory.dmpFilesize
1.5MB
-
memory/3548-9-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3548-12-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3548-14-0x0000000074AAE000-0x0000000074AAF000-memory.dmpFilesize
4KB
-
memory/3548-15-0x00000000403A0000-0x00000000403FE000-memory.dmpFilesize
376KB
-
memory/3548-16-0x0000000074AA0000-0x0000000075250000-memory.dmpFilesize
7.7MB
-
memory/3548-17-0x0000000040400000-0x00000000409A4000-memory.dmpFilesize
5.6MB
-
memory/3548-18-0x0000000074AA0000-0x0000000075250000-memory.dmpFilesize
7.7MB
-
memory/3548-20-0x0000000074AA0000-0x0000000075250000-memory.dmpFilesize
7.7MB
-
memory/3548-19-0x00000000409F0000-0x0000000040A4C000-memory.dmpFilesize
368KB
-
memory/3548-22-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-48-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-46-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-80-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-78-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-74-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-70-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-68-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-66-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-64-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-62-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-60-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-59-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-54-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-1160-0x0000000074AA0000-0x0000000075250000-memory.dmpFilesize
7.7MB
-
memory/3548-1159-0x0000000040B50000-0x0000000040BB6000-memory.dmpFilesize
408KB
-
memory/3548-50-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-44-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-42-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-40-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-38-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-36-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-34-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-32-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-76-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-30-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-72-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-28-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-26-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-56-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-24-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-52-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-21-0x00000000409F0000-0x0000000040A46000-memory.dmpFilesize
344KB
-
memory/3548-1161-0x0000000041400000-0x0000000041450000-memory.dmpFilesize
320KB
-
memory/3548-1162-0x0000000041450000-0x00000000414EC000-memory.dmpFilesize
624KB
-
memory/3548-1163-0x0000000041DB0000-0x0000000041E42000-memory.dmpFilesize
584KB
-
memory/3548-1164-0x0000000041FC0000-0x0000000041FCA000-memory.dmpFilesize
40KB
-
memory/3548-1166-0x0000000074AAE000-0x0000000074AAF000-memory.dmpFilesize
4KB
-
memory/3548-1167-0x0000000074AA0000-0x0000000075250000-memory.dmpFilesize
7.7MB