Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 02:08
Static task
static1
Behavioral task
behavioral1
Sample
invoice_569685.cmd
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
invoice_569685.cmd
Resource
win10v2004-20240508-en
General
-
Target
invoice_569685.cmd
-
Size
3.2MB
-
MD5
a44d0923af9248d5844169ae5e465b5d
-
SHA1
9478acd0c7c630a51ec64a553a135a3f50d135bb
-
SHA256
7d2e08e27b338c8a834d696def4ff2f541e6b19e4d550f42b5c5423fb455e56a
-
SHA512
1035a085fb6c5f94347048433a5b2c78ff23ffff69bcca9114ad4f9e36ea048022652a8234f54912e5ee1c372c66dae6a5d4d4c60fdae2c1d3347abb7a3b2faf
-
SSDEEP
49152:6oxyJptV+hMsrY2Dp1wrmaKY4L/A2v7380MG3LFQzPLDgV4R:K
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 63 IoCs
Processes:
resource yara_rule behavioral1/memory/2064-34-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-38-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-37-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-36-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-35-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-41-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-98-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-42-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-90-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-91-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-88-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-87-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-85-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-84-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-82-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-81-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-80-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-78-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-77-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-75-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-74-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-72-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-71-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-70-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-68-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-65-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-62-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-61-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-59-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-58-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-56-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-54-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-53-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-52-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-49-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-47-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-46-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-44-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-67-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-64-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-50-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-107-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-104-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-101-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-95-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-92-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-89-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-86-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-83-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-79-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-76-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-73-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-69-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-66-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-63-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-60-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-57-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-55-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-51-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-48-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-45-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-43-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 behavioral1/memory/2064-40-0x00000000030E0000-0x00000000040E0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 8 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.exepid process 2284 alpha.exe 2324 alpha.exe 2656 kn.exe 2732 alpha.exe 2712 kn.exe 2064 Audio.pif 2800 alpha.exe 2956 alpha.exe -
Loads dropped DLL 7 IoCs
Processes:
cmd.exealpha.exealpha.exepid process 2232 cmd.exe 2232 cmd.exe 2324 alpha.exe 2232 cmd.exe 2732 alpha.exe 2232 cmd.exe 2232 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Audio.pifpid process 2064 Audio.pif -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exedescription pid process target process PID 2232 wrote to memory of 1916 2232 cmd.exe extrac32.exe PID 2232 wrote to memory of 1916 2232 cmd.exe extrac32.exe PID 2232 wrote to memory of 1916 2232 cmd.exe extrac32.exe PID 2232 wrote to memory of 2284 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2284 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2284 2232 cmd.exe alpha.exe PID 2284 wrote to memory of 2944 2284 alpha.exe extrac32.exe PID 2284 wrote to memory of 2944 2284 alpha.exe extrac32.exe PID 2284 wrote to memory of 2944 2284 alpha.exe extrac32.exe PID 2232 wrote to memory of 2324 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2324 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2324 2232 cmd.exe alpha.exe PID 2324 wrote to memory of 2656 2324 alpha.exe kn.exe PID 2324 wrote to memory of 2656 2324 alpha.exe kn.exe PID 2324 wrote to memory of 2656 2324 alpha.exe kn.exe PID 2232 wrote to memory of 2732 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2732 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2732 2232 cmd.exe alpha.exe PID 2732 wrote to memory of 2712 2732 alpha.exe kn.exe PID 2732 wrote to memory of 2712 2732 alpha.exe kn.exe PID 2732 wrote to memory of 2712 2732 alpha.exe kn.exe PID 2232 wrote to memory of 2064 2232 cmd.exe Audio.pif PID 2232 wrote to memory of 2064 2232 cmd.exe Audio.pif PID 2232 wrote to memory of 2064 2232 cmd.exe Audio.pif PID 2232 wrote to memory of 2064 2232 cmd.exe Audio.pif PID 2232 wrote to memory of 2800 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2800 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2800 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2956 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2956 2232 cmd.exe alpha.exe PID 2232 wrote to memory of 2956 2232 cmd.exe alpha.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 92⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 93⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 123⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\Audio.pifC:\Users\Public\Libraries\Audio.pif2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Audio.mp4Filesize
2.1MB
MD5331acc128c73ca34df0ec4f2773a909d
SHA149efefcf09d9d1e7df14b12e937c78f64d30cd91
SHA256c5d8ddff9277aa014c2612f57059eb7963a5ee7f9393b8dda53c6fedbb93646d
SHA512cf549dbbfa3101f4587c4508fc6b9243831eb41a61ac1b75a8bf78f0d5350a6d50fcc840ae85163368b1254ab532259c0b9fc48053655d6e1dff3434677e65b3
-
C:\Users\Public\Libraries\Audio.pifFilesize
1.1MB
MD5a7665a0ba38d413a4186778d0b589419
SHA1fc281f3d97b91799ce0a0f90da106681810de663
SHA256f9455699d8c8e96c69cb3c8e87336c34655b2f1c39fee7256ead815c444d39b0
SHA512741ba77391db3d64deed3811b2024c91d5cc63c05294bf787ddab0d4dde2b434511f10ea08f466b11db1302a485e6ab04c92eb3ef971de2ad325a16a775e6220
-
C:\Users\Public\alpha.exeFilesize
337KB
MD55746bd7e255dd6a8afa06f7c42c1ba41
SHA10f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA5123a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
-
C:\Users\Public\kn.exeFilesize
1.1MB
MD5ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA2561e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA5124e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2
-
memory/2064-34-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-38-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-37-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-36-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-35-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-39-0x0000000000400000-0x000000000051C000-memory.dmpFilesize
1.1MB
-
memory/2064-41-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-98-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-42-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-90-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-91-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-88-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-87-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-85-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-84-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-82-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-81-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-80-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-78-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-77-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-75-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-74-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-72-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-71-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-70-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-68-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-65-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-62-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-61-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-59-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-58-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-56-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-54-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-53-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-52-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-49-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-47-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-46-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-44-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-67-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-64-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-50-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-107-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-104-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-101-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-95-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-92-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-89-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-86-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-83-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-79-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-76-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-73-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-69-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-66-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-63-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-60-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-57-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-55-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-51-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-48-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-45-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-43-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB
-
memory/2064-40-0x00000000030E0000-0x00000000040E0000-memory.dmpFilesize
16.0MB