Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 19:28
Behavioral task
behavioral1
Sample
09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe
Resource
win10v2004-20240611-en
General
-
Target
09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe
-
Size
90KB
-
MD5
97b87cc28d58abe0e6c36740e18dbf73
-
SHA1
d2d4ac162424cc8e489640fd08f686c22080cf6e
-
SHA256
09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b
-
SHA512
3c9cad41a39a056d25214f59718900bced3820fdad429f4a4238edd4cd724e4087f9d489323511bbb3bc9313e9b71717122a7865390f055bbc4eb5994167f367
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5008-48-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/5008-47-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/5008-52-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/5008-57-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 532 csrsll.exe 4988 csrsll.exe 5008 csrsll.exe -
Processes:
resource yara_rule behavioral2/memory/1224-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/5096-4-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/5096-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1224-9-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/5096-7-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral2/memory/532-34-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/532-46-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/5008-48-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5008-47-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5008-52-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5008-45-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5008-39-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5096-55-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4988-56-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/5008-57-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.execsrsll.exedescription pid process target process PID 1224 set thread context of 5096 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe PID 532 set thread context of 4988 532 csrsll.exe csrsll.exe PID 532 set thread context of 5008 532 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe Token: SeDebugPrivilege 4988 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.execsrsll.execsrsll.exepid process 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 5096 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 532 csrsll.exe 4988 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.execmd.execsrsll.exedescription pid process target process PID 1224 wrote to memory of 5096 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe PID 1224 wrote to memory of 5096 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe PID 1224 wrote to memory of 5096 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe PID 1224 wrote to memory of 5096 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe PID 1224 wrote to memory of 5096 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe PID 1224 wrote to memory of 5096 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe PID 1224 wrote to memory of 5096 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe PID 1224 wrote to memory of 5096 1224 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe PID 5096 wrote to memory of 4716 5096 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe cmd.exe PID 5096 wrote to memory of 4716 5096 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe cmd.exe PID 5096 wrote to memory of 4716 5096 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe cmd.exe PID 4716 wrote to memory of 4808 4716 cmd.exe reg.exe PID 4716 wrote to memory of 4808 4716 cmd.exe reg.exe PID 4716 wrote to memory of 4808 4716 cmd.exe reg.exe PID 5096 wrote to memory of 532 5096 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe csrsll.exe PID 5096 wrote to memory of 532 5096 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe csrsll.exe PID 5096 wrote to memory of 532 5096 09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe csrsll.exe PID 532 wrote to memory of 4988 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 4988 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 4988 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 4988 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 4988 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 4988 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 4988 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 4988 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 5008 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 5008 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 5008 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 5008 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 5008 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 5008 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 5008 532 csrsll.exe csrsll.exe PID 532 wrote to memory of 5008 532 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe"C:\Users\Admin\AppData\Local\Temp\09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe"C:\Users\Admin\AppData\Local\Temp\09325f005ceb976e3b3a85d4a8722b6a49d85c45847473ea4e8d5db860db079b.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BAYEW.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3972,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BAYEW.txtFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
90KB
MD59e4623cc6b5a3360e295eb6c4645e213
SHA19ebff98a42dc2d1be4d304700d5ad4b163766c2f
SHA256fa44cb51263b6ce5ecf19882a2e0daf1161abc016815ef4e0d6deff915f8f0a6
SHA512952fdb5ee1713cc9e00dc28f9f0258a61c8b729c3b4b537e0228528d08f00fa556d50721412d79a2aba87e3d6a9c75ea54405100990574df751154619e31de7f
-
memory/532-46-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/532-34-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1224-9-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1224-5-0x00000000021D0000-0x00000000021D2000-memory.dmpFilesize
8KB
-
memory/1224-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1224-3-0x00000000021C0000-0x00000000021C2000-memory.dmpFilesize
8KB
-
memory/4988-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/5008-45-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5008-48-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5008-47-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5008-52-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5008-39-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5008-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5096-4-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/5096-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/5096-55-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/5096-53-0x0000000000410000-0x00000000004D9000-memory.dmpFilesize
804KB
-
memory/5096-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB