Analysis

  • max time kernel
    148s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    21-06-2024 01:10

General

  • Target

    a9ab6ae9fb0198840b9309d04dfeff8cdacd81a4edcc6bc7c32879608ae765b3.exe

  • Size

    1.5MB

  • MD5

    026413bbfef5671928ad071ec2abb31a

  • SHA1

    65d9c92d986961ea05431a937f75a193a09de3b0

  • SHA256

    a9ab6ae9fb0198840b9309d04dfeff8cdacd81a4edcc6bc7c32879608ae765b3

  • SHA512

    d93cf780d1ad11519e21293254f779fc9fbc14f8fbdd4a86854ed00ce8d39c3bf4c08e7a1da887aeae350c5d3c0a02b9b4e39efd34dbf962ea2d61e3871107c3

  • SSDEEP

    24576:Gb8mxc3aLtwdDxaSQnr9yceV8FCsKbX3bEyh5lMV/M6x:GRdiRgyrlMV/M6

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9ab6ae9fb0198840b9309d04dfeff8cdacd81a4edcc6bc7c32879608ae765b3.exe
    "C:\Users\Admin\AppData\Local\Temp\a9ab6ae9fb0198840b9309d04dfeff8cdacd81a4edcc6bc7c32879608ae765b3.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c mkdir "\\?\C:\Windows "
      2⤵
        PID:3040
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c mkdir "\\?\C:\Windows \System32"
        2⤵
          PID:2380
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "C:\\Windows \\System32\\cmd.pif"
          2⤵
            PID:2280
            • C:\Windows \System32\cmd.pif
              "C:\\Windows \\System32\\cmd.pif"
              3⤵
              • Executes dropped EXE
              PID:2636
            • C:\Windows \System32\cmd.pif
              "C:\Windows \System32\cmd.pif"
              3⤵
              • Executes dropped EXE
              PID:1296
          • C:\Windows\SysWOW64\extrac32.exe
            C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\a9ab6ae9fb0198840b9309d04dfeff8cdacd81a4edcc6bc7c32879608ae765b3.exe C:\\Users\\Public\\Libraries\\Hzvuyzvj.PIF
            2⤵
              PID:2600
            • C:\Users\Public\Libraries\jvzyuvzH.pif
              C:\Users\Public\Libraries\jvzyuvzH.pif
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2916

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows \System32\cmd.pif

            Filesize

            94KB

            MD5

            869640d0a3f838694ab4dfea9e2f544d

            SHA1

            bdc42b280446ba53624ff23f314aadb861566832

            SHA256

            0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

            SHA512

            6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

          • \Users\Public\Libraries\jvzyuvzH.pif

            Filesize

            182KB

            MD5

            3776012e2ef5a5cae6935853e6ca79b2

            SHA1

            4fc81df94baaaa550473ac9d20763cfb786577ff

            SHA256

            8e104cc58e62de0eab837ac09b01d30e85f79045cc1803fa2ef4eafbdbd41e8d

            SHA512

            38811cb1431e8b7b07113ae54f1531f8992bd0e572d9daa1029cf8692396427285a4c089ffd56422ca0c6b393e9fca0856a5a5cd77062e7e71bf0a670843cfb8

          • memory/1936-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

            Filesize

            4KB

          • memory/1936-1-0x00000000002C0000-0x00000000002C1000-memory.dmp

            Filesize

            4KB

          • memory/1936-2-0x0000000000400000-0x0000000000587000-memory.dmp

            Filesize

            1.5MB

          • memory/2916-92-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-70-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-59-0x000000003D980000-0x000000003D9DA000-memory.dmp

            Filesize

            360KB

          • memory/2916-60-0x000000003DBA0000-0x000000003DBFA000-memory.dmp

            Filesize

            360KB

          • memory/2916-64-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-66-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-72-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-80-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-86-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-84-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-82-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-78-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-76-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-55-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

          • memory/2916-74-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-57-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

          • memory/2916-68-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-61-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-62-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-88-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-102-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-114-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-112-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-110-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-108-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-106-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-104-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-100-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-98-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-96-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-94-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB

          • memory/2916-90-0x000000003DBA0000-0x000000003DBF3000-memory.dmp

            Filesize

            332KB