Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 03:17
Behavioral task
behavioral1
Sample
b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe
Resource
win10v2004-20240611-en
General
-
Target
b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe
-
Size
326KB
-
MD5
8c1e120fb5b18346547d05a846718349
-
SHA1
ed4e308f5b908cad5886cfb4a37c75fa61ca88e8
-
SHA256
b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc
-
SHA512
eaaf85b019b52f1190ac2b0e6fd80c82cae1f09882bca35d8d44b50b321371f36075beef370c62b4aeffcfe27681bb9cc4f4a27ae7d771fb9ae36f86a033f6a7
-
SSDEEP
3072:ce2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:csxD5cwohO+O1sVG0/pZ6iPC8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2596-54-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2596-56-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2596-57-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/2596-61-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2596-54-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2596-56-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2596-57-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2596-61-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
UPX dump on OEP (original entry point) 19 IoCs
Processes:
resource yara_rule behavioral2/memory/640-0-0x0000000000400000-0x0000000000454000-memory.dmp UPX behavioral2/memory/3248-4-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/3248-6-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/3248-12-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/3248-10-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/640-13-0x0000000000400000-0x0000000000454000-memory.dmp UPX C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe UPX behavioral2/memory/848-37-0x0000000000400000-0x0000000000454000-memory.dmp UPX behavioral2/memory/848-41-0x0000000000400000-0x0000000000454000-memory.dmp UPX behavioral2/memory/2596-46-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/848-40-0x0000000000400000-0x0000000000454000-memory.dmp UPX behavioral2/memory/2596-51-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/2596-54-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/2596-56-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/2596-57-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral2/memory/848-55-0x0000000000400000-0x0000000000454000-memory.dmp UPX behavioral2/memory/3248-58-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/3368-60-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/2596-61-0x0000000000400000-0x0000000000414000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 848 csrsll.exe 3368 csrsll.exe 2596 csrsll.exe -
Processes:
resource yara_rule behavioral2/memory/640-0-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/3248-4-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3248-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3248-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3248-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/640-13-0x0000000000400000-0x0000000000454000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral2/memory/848-37-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/848-41-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/2596-46-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/848-40-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/2596-51-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2596-54-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2596-56-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2596-57-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/848-55-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/3248-58-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3368-60-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2596-61-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.execsrsll.exedescription pid process target process PID 640 set thread context of 3248 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe PID 848 set thread context of 3368 848 csrsll.exe csrsll.exe PID 848 set thread context of 2596 848 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe Token: SeDebugPrivilege 3368 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exeb800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.execsrsll.execsrsll.exepid process 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe 3248 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe 848 csrsll.exe 3368 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exeb800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.execmd.execsrsll.exedescription pid process target process PID 640 wrote to memory of 3248 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe PID 640 wrote to memory of 3248 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe PID 640 wrote to memory of 3248 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe PID 640 wrote to memory of 3248 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe PID 640 wrote to memory of 3248 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe PID 640 wrote to memory of 3248 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe PID 640 wrote to memory of 3248 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe PID 640 wrote to memory of 3248 640 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe PID 3248 wrote to memory of 1768 3248 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe cmd.exe PID 3248 wrote to memory of 1768 3248 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe cmd.exe PID 3248 wrote to memory of 1768 3248 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe cmd.exe PID 1768 wrote to memory of 3268 1768 cmd.exe reg.exe PID 1768 wrote to memory of 3268 1768 cmd.exe reg.exe PID 1768 wrote to memory of 3268 1768 cmd.exe reg.exe PID 3248 wrote to memory of 848 3248 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe csrsll.exe PID 3248 wrote to memory of 848 3248 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe csrsll.exe PID 3248 wrote to memory of 848 3248 b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe csrsll.exe PID 848 wrote to memory of 3368 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 3368 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 3368 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 3368 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 3368 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 3368 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 3368 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 3368 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 2596 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 2596 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 2596 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 2596 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 2596 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 2596 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 2596 848 csrsll.exe csrsll.exe PID 848 wrote to memory of 2596 848 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe"C:\Users\Admin\AppData\Local\Temp\b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe"C:\Users\Admin\AppData\Local\Temp\b800b3b0ba6b645aabaf1fce78017a5444539aaea5bb5dfcb492eb04cad40ebc.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VXJNS.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
PID:3268 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3368 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
PID:2596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VXJNS.txtFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
326KB
MD539af79c4a64e965201ff5be6d45cf20d
SHA14753c22a9ef8144a7e1e81d318373fdd1e3ccfd6
SHA256d7ae89907a125cb9bb0c1db8ea0ab778a33d419fd290bdea1746a76033dc0d1c
SHA5121187ebcd2f443d091e574513ff5ab3ef7b41d42ad372dd564a2473821a3a20462614b18e7563c64a9db9314409cb58407ac0689503212c2e2d1da9e3dfcc3655
-
memory/640-7-0x00000000021E0000-0x00000000021E2000-memory.dmpFilesize
8KB
-
memory/640-3-0x00000000021C0000-0x00000000021C2000-memory.dmpFilesize
8KB
-
memory/640-0-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/640-13-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/640-9-0x0000000002A50000-0x0000000002A52000-memory.dmpFilesize
8KB
-
memory/640-8-0x00000000021F0000-0x00000000021F2000-memory.dmpFilesize
8KB
-
memory/848-37-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/848-41-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/848-55-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/848-40-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/2596-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2596-46-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2596-51-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2596-54-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2596-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2596-61-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3248-4-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3248-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3248-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3248-12-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3248-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3368-60-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB