Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 05:28
Behavioral task
behavioral1
Sample
f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe
Resource
win10v2004-20240508-en
General
-
Target
f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe
-
Size
90KB
-
MD5
8c7e7d3e585f823bdd65bd217146e98f
-
SHA1
adc3dd87efecab1f9a9814765b3e7d9d1777e6bb
-
SHA256
f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6
-
SHA512
549377f666a44ae4789e9ebc60e0443e4a1421321c2f284caacfb7b2dcf05d3839af675471ebd6f587516541f6a606841de0c084a9ae99a5f1062d0c02fd2a4b
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral2/memory/4748-55-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4748-57-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4748-58-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe -
Executes dropped EXE 3 IoCs
pid Process 384 csrsll.exe 4036 csrsll.exe 4748 csrsll.exe -
resource yara_rule behavioral2/memory/3032-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1540-3-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1540-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3032-10-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3032-5-0x00000000021C0000-0x00000000021C2000-memory.dmp upx behavioral2/memory/1540-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00080000000235c1-27.dat upx behavioral2/memory/384-34-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4748-44-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/384-41-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4036-48-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/384-50-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4748-52-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1540-56-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4748-55-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4748-57-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4748-58-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4036-59-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3032 set thread context of 1540 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 90 PID 384 set thread context of 4036 384 csrsll.exe 102 PID 384 set thread context of 4748 384 csrsll.exe 103 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe Token: SeDebugPrivilege 4036 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 1540 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 384 csrsll.exe 4036 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3032 wrote to memory of 1540 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 90 PID 3032 wrote to memory of 1540 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 90 PID 3032 wrote to memory of 1540 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 90 PID 3032 wrote to memory of 1540 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 90 PID 3032 wrote to memory of 1540 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 90 PID 3032 wrote to memory of 1540 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 90 PID 3032 wrote to memory of 1540 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 90 PID 3032 wrote to memory of 1540 3032 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 90 PID 1540 wrote to memory of 1012 1540 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 93 PID 1540 wrote to memory of 1012 1540 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 93 PID 1540 wrote to memory of 1012 1540 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 93 PID 1012 wrote to memory of 5024 1012 cmd.exe 96 PID 1012 wrote to memory of 5024 1012 cmd.exe 96 PID 1012 wrote to memory of 5024 1012 cmd.exe 96 PID 1540 wrote to memory of 384 1540 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 97 PID 1540 wrote to memory of 384 1540 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 97 PID 1540 wrote to memory of 384 1540 f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe 97 PID 384 wrote to memory of 4036 384 csrsll.exe 102 PID 384 wrote to memory of 4036 384 csrsll.exe 102 PID 384 wrote to memory of 4036 384 csrsll.exe 102 PID 384 wrote to memory of 4036 384 csrsll.exe 102 PID 384 wrote to memory of 4036 384 csrsll.exe 102 PID 384 wrote to memory of 4036 384 csrsll.exe 102 PID 384 wrote to memory of 4036 384 csrsll.exe 102 PID 384 wrote to memory of 4036 384 csrsll.exe 102 PID 384 wrote to memory of 4748 384 csrsll.exe 103 PID 384 wrote to memory of 4748 384 csrsll.exe 103 PID 384 wrote to memory of 4748 384 csrsll.exe 103 PID 384 wrote to memory of 4748 384 csrsll.exe 103 PID 384 wrote to memory of 4748 384 csrsll.exe 103 PID 384 wrote to memory of 4748 384 csrsll.exe 103 PID 384 wrote to memory of 4748 384 csrsll.exe 103 PID 384 wrote to memory of 4748 384 csrsll.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe"C:\Users\Admin\AppData\Local\Temp\f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe"C:\Users\Admin\AppData\Local\Temp\f1de962b298ee088caf5c16af237cee3af27968ba9fe8f7512d66a133c36efe6.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QRNMG.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
PID:5024
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4036
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
PID:4748
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3740,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:81⤵PID:1272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
90KB
MD5e5d04977eb337af75d1bf2c00235af5f
SHA132dc13456bef2dd86d04a57b822cbb0eb5a93e3e
SHA2569bbf04db86ccea2c40bcbe90a8acfb0d601cf6f73a56832ac242d43952e43124
SHA5123601b1842185029d6e178913146595319429737487cbd19abff8b33dd648102f719737d2eb0bdfeeb31fc0a4ca11194eb6eaaa1a23ef0cbb457389da780314bb