Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe
Resource
win10v2004-20240611-en
General
-
Target
0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe
-
Size
1.1MB
-
MD5
7d0932523c11c434d2b132a2cf8a5835
-
SHA1
ac083ec95bcab40b618f4f53b76739be81e283f9
-
SHA256
0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666
-
SHA512
1251d346dfe9e51691beff84b3474c0f5a6e5d24339e9d59eaadba227672a5b358e4c1011b602d8d0f8b950a152817f3b15c071fb379e40d79ede4787fc4e00e
-
SSDEEP
24576:FyDuzoeTyNvZ7BIiETeAXsiK/e9cvYLgc4mguZ:Fz4IPTeAX4qMr3B
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4496-1-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-4-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-3-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-2-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-5-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-6-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-8-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-10-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-15-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-24-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-47-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-64-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-63-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-62-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-61-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-60-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-59-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-58-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-56-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-55-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-54-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-53-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-52-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-51-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-50-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-49-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-46-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-45-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-44-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-43-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-42-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-41-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-40-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-38-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-34-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-33-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-31-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-57-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-28-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-27-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-48-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-39-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-21-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-37-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-36-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-20-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-35-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-19-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-32-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-18-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-30-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-17-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-29-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-26-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-16-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-25-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-23-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-14-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-22-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-13-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-12-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-11-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-9-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 behavioral2/memory/4496-7-0x00000000029B0000-0x00000000039B0000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SndVol.exegrpconv.exedescription pid process target process PID 4248 set thread context of 3520 4248 SndVol.exe Explorer.EXE PID 4248 set thread context of 4844 4248 SndVol.exe grpconv.exe PID 4844 set thread context of 3520 4844 grpconv.exe Explorer.EXE PID 4844 set thread context of 896 4844 grpconv.exe Firefox.exe -
Processes:
grpconv.exedescription ioc process Key created \Registry\User\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 grpconv.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 22 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exeSndVol.exegrpconv.exepid process 4496 0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe 4496 0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4248 SndVol.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
SndVol.exeExplorer.EXEgrpconv.exepid process 4248 SndVol.exe 3520 Explorer.EXE 3520 Explorer.EXE 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe 4844 grpconv.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SndVol.exepid process 4248 SndVol.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
SndVol.exepid process 4248 SndVol.exe 4248 SndVol.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3520 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exeExplorer.EXEgrpconv.exedescription pid process target process PID 4496 wrote to memory of 4248 4496 0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe SndVol.exe PID 4496 wrote to memory of 4248 4496 0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe SndVol.exe PID 4496 wrote to memory of 4248 4496 0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe SndVol.exe PID 4496 wrote to memory of 4248 4496 0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe SndVol.exe PID 3520 wrote to memory of 4844 3520 Explorer.EXE grpconv.exe PID 3520 wrote to memory of 4844 3520 Explorer.EXE grpconv.exe PID 3520 wrote to memory of 4844 3520 Explorer.EXE grpconv.exe PID 4844 wrote to memory of 896 4844 grpconv.exe Firefox.exe PID 4844 wrote to memory of 896 4844 grpconv.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe"C:\Users\Admin\AppData\Local\Temp\0fa941a6b21162bcb1eb878806a660cf6cf2b7fd28cc83744c65c757386f8666.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4496-0-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/4496-1-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-4-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-3-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-2-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-5-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-6-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-8-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-10-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-15-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-24-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-47-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-64-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-63-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-62-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-61-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-60-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-59-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-58-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-56-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-55-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-54-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-53-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-52-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-51-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-50-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-49-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-46-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-45-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-44-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-43-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-42-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-41-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-40-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-38-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-34-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-33-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-31-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-57-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-28-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-27-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-48-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-39-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-21-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-37-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-36-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-20-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-35-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-19-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-32-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-18-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-30-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-17-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-29-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-26-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-16-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-25-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-23-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-14-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-22-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-13-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-12-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-11-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-9-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB
-
memory/4496-7-0x00000000029B0000-0x00000000039B0000-memory.dmpFilesize
16.0MB