Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 16:42
Behavioral task
behavioral1
Sample
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe
Resource
win10v2004-20240426-en
General
-
Target
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe
-
Size
297KB
-
MD5
4616cf19f415bcc7b8424b9dcaf619bd
-
SHA1
14dec267c9c1ef3357b613e3288adecd504a2e14
-
SHA256
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744
-
SHA512
fa38706b3b5fe436851d82ea0a65e87aa2dfd513136d2368b3ed5ff7b60a542d217e564d251b4aaacb1857b1da54c0bcc20622c158d9524eef7242442f69bf9a
-
SSDEEP
6144:LsWXEYOd9nWwfNEfKLZXhoPSgc+I8jd3zYfP7RAVMwcft6U3UxLA0:L17YpvNYK5huNU8jSsMww8UkxT
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2984-15-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 behavioral2/memory/2984-21-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 behavioral2/memory/936-24-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
system.exepid process 2984 system.exe -
Processes:
resource yara_rule behavioral2/memory/936-0-0x0000000000400000-0x00000000004C6000-memory.dmp upx F:\system.exe upx behavioral2/memory/2984-15-0x0000000000400000-0x00000000004C6000-memory.dmp upx behavioral2/memory/2984-21-0x0000000000400000-0x00000000004C6000-memory.dmp upx behavioral2/memory/936-24-0x0000000000400000-0x00000000004C6000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exedescription ioc process File opened (read-only) \??\I: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\L: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\Q: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\R: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\W: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\Y: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\Z: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\U: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\V: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\A: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\B: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\H: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\M: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\S: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\E: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\G: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\J: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\K: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\N: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\O: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\P: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\T: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened (read-only) \??\X: 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exedescription ioc process File created C:\AutoRun.inf 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened for modification C:\AutoRun.inf 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File created F:\AutoRun.inf 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File opened for modification F:\AutoRun.inf 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe -
Drops file in System32 directory 2 IoCs
Processes:
system.exedescription ioc process File created C:\Windows\SysWOW64\_system.exe system.exe File opened for modification C:\Windows\SysWOW64\_system.exe system.exe -
Drops file in Program Files directory 3 IoCs
Processes:
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exesystem.exedescription pid process target process PID 936 wrote to memory of 2984 936 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe system.exe PID 936 wrote to memory of 2984 936 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe system.exe PID 936 wrote to memory of 2984 936 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe system.exe PID 2984 wrote to memory of 5028 2984 system.exe calc.exe PID 2984 wrote to memory of 5028 2984 system.exe calc.exe PID 2984 wrote to memory of 5028 2984 system.exe calc.exe PID 2984 wrote to memory of 2736 2984 system.exe IEXPLORE.EXE PID 2984 wrote to memory of 2736 2984 system.exe IEXPLORE.EXE PID 936 wrote to memory of 5012 936 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe cmd.exe PID 936 wrote to memory of 5012 936 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe cmd.exe PID 936 wrote to memory of 5012 936 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe"C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.batFilesize
248B
MD51ac0db9db1d2c83fd9ab2e9c38520c0c
SHA1538113f681de521c1a5663b6dee2f368730c73c9
SHA256ce061b7dbcb9f9afca3fc5a9866185bda80de05cffb9f69355955d44e5fdbda0
SHA512033cf26f2ac930e42e55300b4f6f8f151aa735277fb7bf61f507284d38e914b90a69c0342731dadf1630ebaecd4dbec55279e8cc0ee0d19e33638f9ff95cd452
-
F:\system.exeFilesize
297KB
MD54616cf19f415bcc7b8424b9dcaf619bd
SHA114dec267c9c1ef3357b613e3288adecd504a2e14
SHA25694968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744
SHA512fa38706b3b5fe436851d82ea0a65e87aa2dfd513136d2368b3ed5ff7b60a542d217e564d251b4aaacb1857b1da54c0bcc20622c158d9524eef7242442f69bf9a
-
memory/936-0-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/936-11-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/936-24-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2984-15-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2984-18-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/2984-21-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB