Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 02:08
Static task
static1
Behavioral task
behavioral1
Sample
invoice_569685.cmd
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
invoice_569685.cmd
Resource
win10v2004-20240508-en
General
-
Target
invoice_569685.cmd
-
Size
3.2MB
-
MD5
a44d0923af9248d5844169ae5e465b5d
-
SHA1
9478acd0c7c630a51ec64a553a135a3f50d135bb
-
SHA256
7d2e08e27b338c8a834d696def4ff2f541e6b19e4d550f42b5c5423fb455e56a
-
SHA512
1035a085fb6c5f94347048433a5b2c78ff23ffff69bcca9114ad4f9e36ea048022652a8234f54912e5ee1c372c66dae6a5d4d4c60fdae2c1d3347abb7a3b2faf
-
SSDEEP
49152:6oxyJptV+hMsrY2Dp1wrmaKY4L/A2v7380MG3LFQzPLDgV4R:K
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1764-30-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-31-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-32-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-29-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-28-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-33-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-35-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-36-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-38-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-40-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-43-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-44-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-53-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-71-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-91-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-90-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-88-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-87-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-85-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-83-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-82-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-81-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-78-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-77-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-76-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-75-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-74-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-73-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-72-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-89-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-86-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-84-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-80-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-79-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-66-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-63-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-70-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-69-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-68-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-67-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-65-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-56-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-64-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-55-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-62-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-61-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-54-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-48-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-60-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-59-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-52-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-58-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-51-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-57-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-50-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-49-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-47-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-46-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-45-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-42-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-41-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-39-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-37-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral2/memory/1764-34-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 -
Executes dropped EXE 8 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.exepid process 4352 alpha.exe 1724 alpha.exe 4240 kn.exe 4016 alpha.exe 3060 kn.exe 1764 Audio.pif 3860 alpha.exe 4860 alpha.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
Processes:
flow ioc 13 drive.google.com 14 drive.google.com 15 drive.google.com 16 drive.google.com 4 drive.google.com 9 drive.google.com 11 drive.google.com -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exedescription pid process target process PID 3672 wrote to memory of 3128 3672 cmd.exe extrac32.exe PID 3672 wrote to memory of 3128 3672 cmd.exe extrac32.exe PID 3672 wrote to memory of 4352 3672 cmd.exe alpha.exe PID 3672 wrote to memory of 4352 3672 cmd.exe alpha.exe PID 4352 wrote to memory of 2564 4352 alpha.exe extrac32.exe PID 4352 wrote to memory of 2564 4352 alpha.exe extrac32.exe PID 3672 wrote to memory of 1724 3672 cmd.exe alpha.exe PID 3672 wrote to memory of 1724 3672 cmd.exe alpha.exe PID 1724 wrote to memory of 4240 1724 alpha.exe kn.exe PID 1724 wrote to memory of 4240 1724 alpha.exe kn.exe PID 3672 wrote to memory of 4016 3672 cmd.exe alpha.exe PID 3672 wrote to memory of 4016 3672 cmd.exe alpha.exe PID 4016 wrote to memory of 3060 4016 alpha.exe kn.exe PID 4016 wrote to memory of 3060 4016 alpha.exe kn.exe PID 3672 wrote to memory of 1764 3672 cmd.exe Audio.pif PID 3672 wrote to memory of 1764 3672 cmd.exe Audio.pif PID 3672 wrote to memory of 1764 3672 cmd.exe Audio.pif PID 3672 wrote to memory of 3860 3672 cmd.exe alpha.exe PID 3672 wrote to memory of 3860 3672 cmd.exe alpha.exe PID 3672 wrote to memory of 4860 3672 cmd.exe alpha.exe PID 3672 wrote to memory of 4860 3672 cmd.exe alpha.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 92⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 93⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 122⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 123⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\Audio.pifC:\Users\Public\Libraries\Audio.pif2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Audio.mp4Filesize
2.1MB
MD5331acc128c73ca34df0ec4f2773a909d
SHA149efefcf09d9d1e7df14b12e937c78f64d30cd91
SHA256c5d8ddff9277aa014c2612f57059eb7963a5ee7f9393b8dda53c6fedbb93646d
SHA512cf549dbbfa3101f4587c4508fc6b9243831eb41a61ac1b75a8bf78f0d5350a6d50fcc840ae85163368b1254ab532259c0b9fc48053655d6e1dff3434677e65b3
-
C:\Users\Public\Libraries\Audio.pifFilesize
1.1MB
MD5a7665a0ba38d413a4186778d0b589419
SHA1fc281f3d97b91799ce0a0f90da106681810de663
SHA256f9455699d8c8e96c69cb3c8e87336c34655b2f1c39fee7256ead815c444d39b0
SHA512741ba77391db3d64deed3811b2024c91d5cc63c05294bf787ddab0d4dde2b434511f10ea08f466b11db1302a485e6ab04c92eb3ef971de2ad325a16a775e6220
-
C:\Users\Public\alpha.exeFilesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
C:\Users\Public\kn.exeFilesize
1.6MB
MD5bd8d9943a9b1def98eb83e0fa48796c2
SHA170e89852f023ab7cde0173eda1208dbb580f1e4f
SHA2568de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA51295630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b
-
memory/1764-30-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-31-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-32-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-29-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-28-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-33-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-35-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-36-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-38-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-40-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-43-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-44-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-53-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-71-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-91-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-90-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-88-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-87-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-85-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-83-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-82-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-81-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-78-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-77-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-76-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-75-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-74-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-73-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-72-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-89-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-86-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-84-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-80-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-79-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-66-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-63-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-70-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-69-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-68-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-67-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-65-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-56-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-64-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-55-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-62-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-61-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-54-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-48-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-60-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-59-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-52-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-58-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-51-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-57-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-50-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-49-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-47-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-46-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-45-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-42-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-41-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-39-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-37-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/1764-34-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB