Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 05:33
Static task
static1
Behavioral task
behavioral1
Sample
Request_for_quote.cmd
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Request_for_quote.cmd
Resource
win10v2004-20240611-en
General
-
Target
Request_for_quote.cmd
-
Size
3.6MB
-
MD5
d29446c9e9edf2b651d5e522ce846d37
-
SHA1
d82034a7239fe5d6bbecc8f9c4853f593eef9a47
-
SHA256
2f6e2df144e53dcc0da8fa7570290ea6aee4de8a479a9d927fe7a85927afe79b
-
SHA512
80d684da92ac401be96260975e6756fc38cba3734de1e3bcd36a3850da0d2d878480cce02903aabde19c07437063b8b050b0f0cac1e07d4ab374b66c86b88f4d
-
SSDEEP
49152:vgk00JywMTAermhoGyBDj1kwXui5zlrT2Da0QhGQ:q
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 61 IoCs
Processes:
resource yara_rule behavioral1/memory/2660-37-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-34-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-36-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-35-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-38-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-43-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-40-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-42-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-41-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-44-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-50-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-47-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-51-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-49-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-48-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-54-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-84-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-76-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-73-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-72-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-68-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-66-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-64-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-62-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-59-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-119-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-117-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-116-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-114-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-112-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-109-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-107-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-105-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-102-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-100-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-98-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-95-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-93-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-91-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-89-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-86-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-82-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-80-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-78-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-77-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-75-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-74-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-71-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-70-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-69-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-67-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-65-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-63-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-61-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-60-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-58-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-57-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-56-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-55-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-53-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 behavioral1/memory/2660-52-0x0000000003190000-0x0000000004190000-memory.dmp modiloader_stage2 -
Executes dropped EXE 8 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.exepid process 3008 alpha.exe 2536 alpha.exe 2092 kn.exe 1972 alpha.exe 2596 kn.exe 2660 Audio.pif 2712 alpha.exe 2600 alpha.exe -
Loads dropped DLL 9 IoCs
Processes:
cmd.exealpha.exealpha.exeWerFault.exepid process 2360 cmd.exe 2360 cmd.exe 2536 alpha.exe 2360 cmd.exe 1972 alpha.exe 2360 cmd.exe 2360 cmd.exe 2916 WerFault.exe 2916 WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2916 2660 WerFault.exe Audio.pif -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Audio.pifpid process 2660 Audio.pif -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exeAudio.pifdescription pid process target process PID 2360 wrote to memory of 1032 2360 cmd.exe extrac32.exe PID 2360 wrote to memory of 1032 2360 cmd.exe extrac32.exe PID 2360 wrote to memory of 1032 2360 cmd.exe extrac32.exe PID 2360 wrote to memory of 3008 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 3008 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 3008 2360 cmd.exe alpha.exe PID 3008 wrote to memory of 3068 3008 alpha.exe extrac32.exe PID 3008 wrote to memory of 3068 3008 alpha.exe extrac32.exe PID 3008 wrote to memory of 3068 3008 alpha.exe extrac32.exe PID 2360 wrote to memory of 2536 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 2536 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 2536 2360 cmd.exe alpha.exe PID 2536 wrote to memory of 2092 2536 alpha.exe kn.exe PID 2536 wrote to memory of 2092 2536 alpha.exe kn.exe PID 2536 wrote to memory of 2092 2536 alpha.exe kn.exe PID 2360 wrote to memory of 1972 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 1972 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 1972 2360 cmd.exe alpha.exe PID 1972 wrote to memory of 2596 1972 alpha.exe kn.exe PID 1972 wrote to memory of 2596 1972 alpha.exe kn.exe PID 1972 wrote to memory of 2596 1972 alpha.exe kn.exe PID 2360 wrote to memory of 2660 2360 cmd.exe Audio.pif PID 2360 wrote to memory of 2660 2360 cmd.exe Audio.pif PID 2360 wrote to memory of 2660 2360 cmd.exe Audio.pif PID 2360 wrote to memory of 2660 2360 cmd.exe Audio.pif PID 2360 wrote to memory of 2712 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 2712 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 2712 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 2600 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 2600 2360 cmd.exe alpha.exe PID 2360 wrote to memory of 2600 2360 cmd.exe alpha.exe PID 2660 wrote to memory of 2916 2660 Audio.pif WerFault.exe PID 2660 wrote to memory of 2916 2660 Audio.pif WerFault.exe PID 2660 wrote to memory of 2916 2660 Audio.pif WerFault.exe PID 2660 wrote to memory of 2916 2660 Audio.pif WerFault.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Request_for_quote.cmd"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Request_for_quote.cmd" "C:\\Users\\Public\\Audio.mp4" 92⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Request_for_quote.cmd" "C:\\Users\\Public\\Audio.mp4" 93⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 123⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\Audio.pifC:\Users\Public\Libraries\Audio.pif2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 7123⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Audio.mp4Filesize
2.5MB
MD5c859f93aa10d99f710dd3bc4c9b40215
SHA16bd829ae9d371d75e1ac57788aa4c9b13c651d27
SHA256fa5262b6e57568140f7f89e07e949afd550faac222219d8c778e7db8a57ad483
SHA5121b89a289f3775e4b614f5ab7e3f43631f19a83a963430e0f9c76a272c89331cd55117124baeef23642d0a1000e28dfd40103c6e945103e9005fbd0ed36494c40
-
C:\Users\Public\Libraries\Audio.pifFilesize
1.2MB
MD55fd1a661a35d7499e045c69c44467802
SHA19ac38fe292dc9489d703c610336f40ce04c946d9
SHA256b78c87ab78cad5d91aad4aa96dc3bd44722bcb0f81ab87ef37ea4d8eede0f76b
SHA5128702a9e01bd88b837929e380b3e2b9f3a43b9ac147eb77b0fb1cbc5741a0997590addd800f92a75f2c8d7cf5ed903d70ea5bf42f89334e9252d0dec03ae1aded
-
C:\Users\Public\kn.exeFilesize
1.1MB
MD5ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA2561e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA5124e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2
-
\Users\Public\alpha.exeFilesize
337KB
MD55746bd7e255dd6a8afa06f7c42c1ba41
SHA10f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA5123a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
-
memory/2660-37-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-34-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-36-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-35-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-39-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/2660-38-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-43-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-40-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-42-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-41-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-44-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-50-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-47-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-51-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-49-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-48-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-54-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-84-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-76-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-73-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-72-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-68-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-66-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-64-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-62-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-59-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-119-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-117-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-116-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-114-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-112-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-109-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-107-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-105-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-102-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-100-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-98-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-95-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-93-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-91-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-89-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-86-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-82-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-80-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-78-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-77-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-75-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-74-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-71-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-70-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-69-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-67-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-65-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-63-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-61-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-60-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-58-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-57-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-56-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-55-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-53-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB
-
memory/2660-52-0x0000000003190000-0x0000000004190000-memory.dmpFilesize
16.0MB