Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 19:26
Behavioral task
behavioral1
Sample
19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe
Resource
win10v2004-20240508-en
General
-
Target
19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe
-
Size
130KB
-
MD5
6beabbaccc7b872fdb9f706c27f44a20
-
SHA1
f7fee0c8b9c72893ca11df3ec17f534dbd56b5ab
-
SHA256
19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6
-
SHA512
4d915b29bfbf0a937ea5071ea770bf713cefde6de2094e83e54fa47ee8a9f8b280a4bfc1f3a978ac629533364bfdc1d9da8fb74e55388a1c9d83101caa049c79
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZ:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2028-50-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2028-51-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2028-53-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2028-47-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2028-55-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2028-50-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2028-51-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2028-53-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2028-47-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2028-55-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
UPX dump on OEP (original entry point) 13 IoCs
Processes:
resource yara_rule behavioral2/memory/1500-0-0x0000000000400000-0x0000000000423000-memory.dmp UPX behavioral2/memory/4848-7-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/4848-9-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/1500-12-0x0000000000400000-0x0000000000423000-memory.dmp UPX behavioral2/memory/4848-11-0x0000000000400000-0x000000000040B000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe UPX behavioral2/memory/4676-36-0x0000000000400000-0x0000000000423000-memory.dmp UPX behavioral2/memory/4676-39-0x0000000000400000-0x0000000000423000-memory.dmp UPX behavioral2/memory/4676-40-0x0000000000400000-0x0000000000423000-memory.dmp UPX behavioral2/memory/4676-43-0x0000000000400000-0x0000000000423000-memory.dmp UPX behavioral2/memory/4676-54-0x0000000000400000-0x0000000000423000-memory.dmp UPX behavioral2/memory/4848-56-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/4772-58-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 4676 Flaseher.exe 4772 Flaseher.exe 2028 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/1500-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4848-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4848-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1500-12-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4848-11-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/4676-36-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4676-39-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4676-40-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4676-43-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4676-54-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4848-56-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4772-58-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exeFlaseher.exedescription pid process target process PID 1500 set thread context of 4848 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe PID 4676 set thread context of 4772 4676 Flaseher.exe Flaseher.exe PID 4676 set thread context of 2028 4676 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe Token: SeDebugPrivilege 4772 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exeFlaseher.exeFlaseher.exepid process 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 4848 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 4676 Flaseher.exe 4772 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.execmd.exeFlaseher.exedescription pid process target process PID 1500 wrote to memory of 4848 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe PID 1500 wrote to memory of 4848 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe PID 1500 wrote to memory of 4848 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe PID 1500 wrote to memory of 4848 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe PID 1500 wrote to memory of 4848 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe PID 1500 wrote to memory of 4848 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe PID 1500 wrote to memory of 4848 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe PID 1500 wrote to memory of 4848 1500 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe PID 4848 wrote to memory of 1872 4848 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe cmd.exe PID 4848 wrote to memory of 1872 4848 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe cmd.exe PID 4848 wrote to memory of 1872 4848 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe cmd.exe PID 1872 wrote to memory of 5080 1872 cmd.exe reg.exe PID 1872 wrote to memory of 5080 1872 cmd.exe reg.exe PID 1872 wrote to memory of 5080 1872 cmd.exe reg.exe PID 4848 wrote to memory of 4676 4848 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe Flaseher.exe PID 4848 wrote to memory of 4676 4848 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe Flaseher.exe PID 4848 wrote to memory of 4676 4848 19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe Flaseher.exe PID 4676 wrote to memory of 4772 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 4772 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 4772 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 4772 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 4772 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 4772 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 4772 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 4772 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe PID 4676 wrote to memory of 2028 4676 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe"C:\Users\Admin\AppData\Local\Temp\19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe"C:\Users\Admin\AppData\Local\Temp\19e78d4d902853cdd11a4d826f03dd6fcaaa856c080651df22fa26dd5f3f53a6.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WESRD.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WESRD.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
130KB
MD57cf9d3e214cde1c39797a066eb7303e9
SHA1ce60c7f7466370ab558a71dc10a1294dcce7597a
SHA25676ec6c3d016e552fceb0eae5ff02f289a402655dbc3a14e766b924c9c84e1c7a
SHA512cfc75bb1fbf2ce2ed08c0bd3bc563f07d60b8db4456aebfc78774a34e5bdbaba0ce2eefb17ac12e34a3e032b704645ede8b2f54a96fbb5a6fb8907f925bf8dcf
-
memory/1500-5-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/1500-4-0x0000000002A90000-0x0000000002A91000-memory.dmpFilesize
4KB
-
memory/1500-3-0x0000000002A60000-0x0000000002A61000-memory.dmpFilesize
4KB
-
memory/1500-6-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/1500-0-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1500-10-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/1500-12-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2028-47-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2028-53-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2028-50-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2028-55-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2028-51-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4676-36-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4676-43-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4676-40-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4676-39-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4676-54-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4772-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4848-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4848-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4848-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4848-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB