Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 16:42
Behavioral task
behavioral1
Sample
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe
Resource
win10v2004-20240426-en
General
-
Target
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe
-
Size
297KB
-
MD5
4616cf19f415bcc7b8424b9dcaf619bd
-
SHA1
14dec267c9c1ef3357b613e3288adecd504a2e14
-
SHA256
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744
-
SHA512
fa38706b3b5fe436851d82ea0a65e87aa2dfd513136d2368b3ed5ff7b60a542d217e564d251b4aaacb1857b1da54c0bcc20622c158d9524eef7242442f69bf9a
-
SSDEEP
6144:LsWXEYOd9nWwfNEfKLZXhoPSgc+I8jd3zYfP7RAVMwcft6U3UxLA0:L17YpvNYK5huNU8jSsMww8UkxT
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2976-39-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 behavioral1/memory/2908-41-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2696 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
system.exepid process 2976 system.exe -
Loads dropped DLL 2 IoCs
Processes:
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exepid process 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe -
Processes:
resource yara_rule behavioral1/memory/2908-0-0x0000000000400000-0x00000000004C6000-memory.dmp upx F:\system.exe upx behavioral1/memory/2908-18-0x0000000002EC0000-0x0000000002F86000-memory.dmp upx behavioral1/memory/2976-39-0x0000000000400000-0x00000000004C6000-memory.dmp upx behavioral1/memory/2628-29-0x0000000000400000-0x00000000004C6000-memory.dmp upx behavioral1/memory/2908-41-0x0000000000400000-0x00000000004C6000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exedescription ioc process File opened (read-only) \??\Q: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\S: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\T: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\X: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\Y: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\O: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\R: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\U: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\W: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\A: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\G: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\H: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\L: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\Z: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\P: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\B: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\E: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\I: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\J: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\K: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\M: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\N: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\V: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exedescription ioc process File created C:\AutoRun.inf 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened for modification C:\AutoRun.inf 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File created F:\AutoRun.inf 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened for modification F:\AutoRun.inf 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe -
Drops file in System32 directory 2 IoCs
Processes:
system.exedescription ioc process File created C:\Windows\SysWOW64\_system.exe system.exe File opened for modification C:\Windows\SysWOW64\_system.exe system.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
system.exedescription pid process target process PID 2976 set thread context of 2628 2976 system.exe calc.exe -
Drops file in Program Files directory 3 IoCs
Processes:
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exesystem.exedescription pid process target process PID 2908 wrote to memory of 2976 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe system.exe PID 2908 wrote to memory of 2976 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe system.exe PID 2908 wrote to memory of 2976 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe system.exe PID 2908 wrote to memory of 2976 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe system.exe PID 2976 wrote to memory of 2628 2976 system.exe calc.exe PID 2976 wrote to memory of 2628 2976 system.exe calc.exe PID 2976 wrote to memory of 2628 2976 system.exe calc.exe PID 2976 wrote to memory of 2628 2976 system.exe calc.exe PID 2976 wrote to memory of 2628 2976 system.exe calc.exe PID 2976 wrote to memory of 2628 2976 system.exe calc.exe PID 2976 wrote to memory of 2680 2976 system.exe IEXPLORE.EXE PID 2976 wrote to memory of 2680 2976 system.exe IEXPLORE.EXE PID 2976 wrote to memory of 2680 2976 system.exe IEXPLORE.EXE PID 2976 wrote to memory of 2680 2976 system.exe IEXPLORE.EXE PID 2908 wrote to memory of 2696 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe cmd.exe PID 2908 wrote to memory of 2696 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe cmd.exe PID 2908 wrote to memory of 2696 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe cmd.exe PID 2908 wrote to memory of 2696 2908 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe"C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ReDelBat.batFilesize
248B
MD51ac0db9db1d2c83fd9ab2e9c38520c0c
SHA1538113f681de521c1a5663b6dee2f368730c73c9
SHA256ce061b7dbcb9f9afca3fc5a9866185bda80de05cffb9f69355955d44e5fdbda0
SHA512033cf26f2ac930e42e55300b4f6f8f151aa735277fb7bf61f507284d38e914b90a69c0342731dadf1630ebaecd4dbec55279e8cc0ee0d19e33638f9ff95cd452
-
F:\system.exeFilesize
297KB
MD54616cf19f415bcc7b8424b9dcaf619bd
SHA114dec267c9c1ef3357b613e3288adecd504a2e14
SHA25694968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744
SHA512fa38706b3b5fe436851d82ea0a65e87aa2dfd513136d2368b3ed5ff7b60a542d217e564d251b4aaacb1857b1da54c0bcc20622c158d9524eef7242442f69bf9a
-
memory/2628-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2628-29-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2908-0-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2908-1-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2908-18-0x0000000002EC0000-0x0000000002F86000-memory.dmpFilesize
792KB
-
memory/2908-20-0x0000000002EC0000-0x0000000002F86000-memory.dmpFilesize
792KB
-
memory/2908-41-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2976-24-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2976-39-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB