Analysis

  • max time kernel
    13s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 23:34

General

  • Target

    73b259c72cb2531e001a0eaa1c9d87d1a2c0385fb6073eb9f9782273db0903e2.exe

  • Size

    112KB

  • MD5

    78a5ea6b57d8b722d7c42b0c7ef3d1da

  • SHA1

    9edcb82d629f6e58331e06a504916f24a19bb13f

  • SHA256

    73b259c72cb2531e001a0eaa1c9d87d1a2c0385fb6073eb9f9782273db0903e2

  • SHA512

    fde35984361d1e02a81da4c1a8cc19b8b15e745cbaab245ca576cd7fae8f192b4998a4a078b7482c067fd93fda129032bbb7a0624def57fa05e77198a3f119bc

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • ModiLoader Second Stage 1 IoCs
  • UPX dump on OEP (original entry point) 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73b259c72cb2531e001a0eaa1c9d87d1a2c0385fb6073eb9f9782273db0903e2.exe
    "C:\Users\Admin\AppData\Local\Temp\73b259c72cb2531e001a0eaa1c9d87d1a2c0385fb6073eb9f9782273db0903e2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2412
    • C:\Users\Admin\AppData\Local\Temp\73b259c72cb2531e001a0eaa1c9d87d1a2c0385fb6073eb9f9782273db0903e2.exe
      "C:\Users\Admin\AppData\Local\Temp\73b259c72cb2531e001a0eaa1c9d87d1a2c0385fb6073eb9f9782273db0903e2.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\RPNSF.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
          4⤵
          • Adds Run key to start application
          PID:1764
      • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:2680
        • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2932
        • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
          4⤵
          • Executes dropped EXE
          PID:1440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RPNSF.bat

    Filesize

    148B

    MD5

    3a4614705555abb049c3298e61170b7f

    SHA1

    c8686410756f346d9551256a5b878b04770950ba

    SHA256

    cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

    SHA512

    65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

  • \Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

    Filesize

    112KB

    MD5

    04964fb57a27f708fbdc2dd3df99ce7a

    SHA1

    139304f800ce355a405e8e3710a7b895da0dccc7

    SHA256

    5e8a771767cdc1ad1ecb890610d1d6677ebfa73ef432b7f60693a7ef07b3ffc2

    SHA512

    a21cfb4cda23aa811f5bf19b79aeb9e088b828d594c1edfbcc6872585791b449bdce86b19dbfa18e81b0564a27026d2151d89987418d3ecb7ba913003df517e3

  • memory/1440-282-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1848-76-0x0000000000450000-0x0000000000452000-memory.dmp

    Filesize

    8KB

  • memory/1848-81-0x0000000000470000-0x0000000000471000-memory.dmp

    Filesize

    4KB

  • memory/1848-28-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/1848-32-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/1848-50-0x00000000003E0000-0x00000000003E2000-memory.dmp

    Filesize

    8KB

  • memory/1848-51-0x00000000003F0000-0x00000000003F2000-memory.dmp

    Filesize

    8KB

  • memory/1848-38-0x00000000003E0000-0x00000000003E2000-memory.dmp

    Filesize

    8KB

  • memory/1848-14-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/1848-89-0x0000000000490000-0x0000000000492000-memory.dmp

    Filesize

    8KB

  • memory/1848-20-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/1848-8-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/1848-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1848-4-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2328-128-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2328-285-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2328-116-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2328-114-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2328-112-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2328-110-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2328-108-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2412-119-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2412-92-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2412-107-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2412-117-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2412-129-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2412-90-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2412-290-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2932-275-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2932-293-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB