Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 03:30
Behavioral task
behavioral1
Sample
377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe
Resource
win10v2004-20240508-en
General
-
Target
377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe
-
Size
90KB
-
MD5
ff784d54993353c9c90531c4768b3700
-
SHA1
e26415b4c384c0b6a9ce5c216e400aad9e6c73d1
-
SHA256
377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1
-
SHA512
7e65378b75cb14996f16c684f6c61aaaed6c24513b8e7d771cd15477604676f2ed1c63f05363fcd9a87fb33a6760f250d45ac5fd9eef188f6feac9a5f3d66287
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/1744-244-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1744-255-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
pid Process 1740 csrsll.exe 584 csrsll.exe 1744 csrsll.exe -
Loads dropped DLL 5 IoCs
pid Process 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe -
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2372-88-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2420-100-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2420-103-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2372-102-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2420-99-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2420-97-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2420-93-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2420-91-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000e000000013178-128.dat upx behavioral1/memory/1740-144-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1740-204-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1744-244-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/584-243-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2420-249-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1740-246-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/584-254-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1744-255-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2372 set thread context of 2420 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 28 PID 1740 set thread context of 584 1740 csrsll.exe 33 PID 1740 set thread context of 1744 1740 csrsll.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe Token: SeDebugPrivilege 584 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 1740 csrsll.exe 584 csrsll.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2420 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 28 PID 2372 wrote to memory of 2420 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 28 PID 2372 wrote to memory of 2420 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 28 PID 2372 wrote to memory of 2420 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 28 PID 2372 wrote to memory of 2420 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 28 PID 2372 wrote to memory of 2420 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 28 PID 2372 wrote to memory of 2420 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 28 PID 2372 wrote to memory of 2420 2372 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 28 PID 2420 wrote to memory of 1964 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 29 PID 2420 wrote to memory of 1964 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 29 PID 2420 wrote to memory of 1964 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 29 PID 2420 wrote to memory of 1964 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 29 PID 1964 wrote to memory of 2144 1964 cmd.exe 31 PID 1964 wrote to memory of 2144 1964 cmd.exe 31 PID 1964 wrote to memory of 2144 1964 cmd.exe 31 PID 1964 wrote to memory of 2144 1964 cmd.exe 31 PID 2420 wrote to memory of 1740 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 32 PID 2420 wrote to memory of 1740 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 32 PID 2420 wrote to memory of 1740 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 32 PID 2420 wrote to memory of 1740 2420 377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe 32 PID 1740 wrote to memory of 584 1740 csrsll.exe 33 PID 1740 wrote to memory of 584 1740 csrsll.exe 33 PID 1740 wrote to memory of 584 1740 csrsll.exe 33 PID 1740 wrote to memory of 584 1740 csrsll.exe 33 PID 1740 wrote to memory of 584 1740 csrsll.exe 33 PID 1740 wrote to memory of 584 1740 csrsll.exe 33 PID 1740 wrote to memory of 584 1740 csrsll.exe 33 PID 1740 wrote to memory of 584 1740 csrsll.exe 33 PID 1740 wrote to memory of 1744 1740 csrsll.exe 34 PID 1740 wrote to memory of 1744 1740 csrsll.exe 34 PID 1740 wrote to memory of 1744 1740 csrsll.exe 34 PID 1740 wrote to memory of 1744 1740 csrsll.exe 34 PID 1740 wrote to memory of 1744 1740 csrsll.exe 34 PID 1740 wrote to memory of 1744 1740 csrsll.exe 34 PID 1740 wrote to memory of 1744 1740 csrsll.exe 34 PID 1740 wrote to memory of 1744 1740 csrsll.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe"C:\Users\Admin\AppData\Local\Temp\377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe"C:\Users\Admin\AppData\Local\Temp\377e1f0ad9e7ce43d9f42cd6fe9457fe2483f797771829217365d7806c6557a1.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GLYHH.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
PID:2144
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:584
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
PID:1744
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
90KB
MD57cdec885e203801f4bae0ac5658069da
SHA1f8f360d6764aac1fc45060dea91760be1c1f98ac
SHA2562cfdbfec638f12aca4bb627c5da40cf1f1f62d009f204d5b143d5b9390bb69ff
SHA5120eec27ad637e4dda88717a527d2b159588f5b7c96feea89f3b5850c0cb298f6c0c002b7bd6c53f965355e10acb49198a63173aed7a0b522f551e0301bed972bb