Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 08:15
Static task
static1
Behavioral task
behavioral1
Sample
hesaphareketi-01.cmd
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
hesaphareketi-01.cmd
Resource
win10v2004-20240508-en
General
-
Target
hesaphareketi-01.cmd
-
Size
4.3MB
-
MD5
a4be8d3b4bcc7db0198c4b47d86cce16
-
SHA1
a18a8390e914debee1172c82e43c784f525009c7
-
SHA256
6ff59a7a9bb26552d874bf03ffd04b7c152184e443d09f79a4f2459f8a04dd55
-
SHA512
6cab41c6d7a72e08bb880311d3ec4996fe0cb265b5125e1b7eb451e11914644b2ef18487bacb607bb1eb9cdbb7c3f53bbb3ba403d6e961f9a5aa0cbb61aa12e1
-
SSDEEP
24576:45Mrv/oEbMykRyeB182egMdyhXTKrXscV/bcsHuurHP0OSRB/KdHQO+j7G/0Rxa8:4KrDQy0P82syhXTdO/Q2BP05idd8dko
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 57 IoCs
Processes:
resource yara_rule behavioral1/memory/2632-34-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-37-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-38-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-36-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-35-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-41-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-42-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-44-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-40-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-43-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-46-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-49-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-48-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-47-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-50-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-53-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-55-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-54-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-57-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-56-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-62-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-59-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-63-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-61-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-60-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-65-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-69-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-68-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-67-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-66-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-71-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-70-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-73-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-72-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-74-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-77-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-84-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-122-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-120-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-118-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-116-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-113-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-111-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-109-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-108-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-106-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-103-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-101-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-99-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-96-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-94-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-92-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-89-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-87-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-82-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-78-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 behavioral1/memory/2632-76-0x00000000033A0000-0x00000000043A0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 8 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.exepid process 2460 alpha.exe 1972 alpha.exe 2596 kn.exe 2692 alpha.exe 2716 kn.exe 2632 Audio.pif 2728 alpha.exe 2672 alpha.exe -
Loads dropped DLL 7 IoCs
Processes:
cmd.exealpha.exealpha.exepid process 1644 cmd.exe 1644 cmd.exe 1972 alpha.exe 1644 cmd.exe 2692 alpha.exe 1644 cmd.exe 1644 cmd.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Audio.pifpid process 2632 Audio.pif -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exedescription pid process target process PID 1644 wrote to memory of 2036 1644 cmd.exe extrac32.exe PID 1644 wrote to memory of 2036 1644 cmd.exe extrac32.exe PID 1644 wrote to memory of 2036 1644 cmd.exe extrac32.exe PID 1644 wrote to memory of 2460 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 2460 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 2460 1644 cmd.exe alpha.exe PID 2460 wrote to memory of 2772 2460 alpha.exe extrac32.exe PID 2460 wrote to memory of 2772 2460 alpha.exe extrac32.exe PID 2460 wrote to memory of 2772 2460 alpha.exe extrac32.exe PID 1644 wrote to memory of 1972 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 1972 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 1972 1644 cmd.exe alpha.exe PID 1972 wrote to memory of 2596 1972 alpha.exe kn.exe PID 1972 wrote to memory of 2596 1972 alpha.exe kn.exe PID 1972 wrote to memory of 2596 1972 alpha.exe kn.exe PID 1644 wrote to memory of 2692 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 2692 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 2692 1644 cmd.exe alpha.exe PID 2692 wrote to memory of 2716 2692 alpha.exe kn.exe PID 2692 wrote to memory of 2716 2692 alpha.exe kn.exe PID 2692 wrote to memory of 2716 2692 alpha.exe kn.exe PID 1644 wrote to memory of 2632 1644 cmd.exe Audio.pif PID 1644 wrote to memory of 2632 1644 cmd.exe Audio.pif PID 1644 wrote to memory of 2632 1644 cmd.exe Audio.pif PID 1644 wrote to memory of 2632 1644 cmd.exe Audio.pif PID 1644 wrote to memory of 2728 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 2728 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 2728 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 2672 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 2672 1644 cmd.exe alpha.exe PID 1644 wrote to memory of 2672 1644 cmd.exe alpha.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd" "C:\\Users\\Public\\Audio.mp4" 92⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd" "C:\\Users\\Public\\Audio.mp4" 93⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 123⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\Audio.pifC:\Users\Public\Libraries\Audio.pif2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Audio.mp4Filesize
3.0MB
MD52b394a65ee90021cb0990dbdb9ee43bb
SHA1341e96b53dfb4831dfe1f3334cfb6405df173f52
SHA256e106349c4b793aac809fd7b11dca2cf1a293fecd584071e9ed0b48cb0bdff857
SHA51251eae123e69dbf6d040d88f8984b9cdb8de16c0035f05a0c355c3f2d9b372706a7c8e6bf554051842980fb043328350d380c6590ac05cefb0996ddd9a9bd3680
-
C:\Users\Public\Libraries\Audio.pifFilesize
1.5MB
MD51a7ed7270f975e1aedd73a800e17a40b
SHA16a7b00eb876108cbbcbeaef40448ecf34a518d59
SHA256a6d0ab763d30f720839b50458cf1e4ab601f5574dd6d835aa17488535e89bd3b
SHA512289ef44a7e171145232f497075596bdba81f53016a8d16935a20069396f91548e5643b1fab2264613f54cb34c12974529ab01fd6e5b3a78708557df2e00781f7
-
\Users\Public\alpha.exeFilesize
337KB
MD55746bd7e255dd6a8afa06f7c42c1ba41
SHA10f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA5123a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
-
\Users\Public\kn.exeFilesize
1.1MB
MD5ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA2561e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA5124e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2
-
memory/2632-34-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-37-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-38-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-36-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-35-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-39-0x0000000000400000-0x0000000000589000-memory.dmpFilesize
1.5MB
-
memory/2632-41-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-42-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-44-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-40-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-43-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-46-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-49-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-48-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-47-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-50-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-53-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-55-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-54-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-57-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-56-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-62-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-59-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-63-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-61-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-60-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-65-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-69-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-68-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-67-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-66-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-71-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-70-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-73-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-72-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-74-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-77-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-84-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-122-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-120-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-118-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-116-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-113-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-111-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-109-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-108-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-106-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-103-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-101-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-99-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-96-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-94-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-92-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-89-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-87-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-82-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-78-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB
-
memory/2632-76-0x00000000033A0000-0x00000000043A0000-memory.dmpFilesize
16.0MB