Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 08:36

General

  • Target

    PAYMENT TRANSFER ERROR.PDF.bat

  • Size

    6.1MB

  • MD5

    9981f8d217254ed2a4cb7a3356535cd5

  • SHA1

    7ae24e3a9c0a28901c24958a17bdf8b344eab454

  • SHA256

    de6f03e7fe7a7c5aa0462d01bd825650bd44acb38e130fc106de4b2c63d7f046

  • SHA512

    6f2168d9e024df2e0e196ecc5896bd42046c16e0dae8bf20c6f16ae7f46ce89f88730847cb878dfe4079a851405456a8ad024a35f2642ed8442c721172465ac2

  • SSDEEP

    49152:W8rzn3QeR6gIn+Sk954nuF83R5H93MUJBHeMrdrekrLwptyyD4kA+mfMea6Nc6:+

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PAYMENT TRANSFER ERROR.PDF.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Windows\System32\extrac32.exe
      C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
      2⤵
        PID:1856
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Windows\system32\extrac32.exe
          extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          3⤵
            PID:1012
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PAYMENT TRANSFER ERROR.PDF.bat" "C:\\Users\\Public\\AHA.GIF" 3
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4876
          • C:\Users\Public\kn.exe
            C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PAYMENT TRANSFER ERROR.PDF.bat" "C:\\Users\\Public\\AHA.GIF" 3
            3⤵
            • Executes dropped EXE
            PID:5032
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AHA.GIF" "C:\\Users\\Public\\Libraries\\AHA.COM" 10
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3676
          • C:\Users\Public\kn.exe
            C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AHA.GIF" "C:\\Users\\Public\\Libraries\\AHA.COM" 10
            3⤵
            • Executes dropped EXE
            PID:1668
        • C:\Users\Public\Libraries\AHA.COM
          C:\Users\Public\Libraries\AHA.COM
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2364
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\jkzjblcW.cmd" "
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4684
            • C:\Windows\SysWOW64\esentutl.exe
              C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
              4⤵
                PID:1984
              • C:\Windows\SysWOW64\esentutl.exe
                C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:1964
              • C:\Users\Public\alpha.pif
                C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3128
              • C:\Users\Public\alpha.pif
                C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1064
              • C:\Users\Public\alpha.pif
                C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4440
                • C:\Users\Public\xpha.pif
                  C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3956
              • C:\Windows \SysWOW64\per.exe
                "C:\\Windows \\SysWOW64\\per.exe
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1672
                • C:\Windows\SYSTEM32\esentutl.exe
                  esentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o
                  5⤵
                    PID:3624
                  • C:\Users\Public\pha.pif
                    C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'
                    5⤵
                    • Executes dropped EXE
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2236
                • C:\Users\Public\alpha.pif
                  C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:232
                • C:\Users\Public\alpha.pif
                  C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1844
                • C:\Users\Public\alpha.pif
                  C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5056
              • C:\Windows\SysWOW64\esentutl.exe
                C:\\Windows\\System32\\esentutl.exe /y C:\Users\Public\Libraries\AHA.COM /d C:\\Users\\Public\\Libraries\\Wclbjzkj.PIF /o
                3⤵
                  PID:744
                • C:\Windows\SysWOW64\SndVol.exe
                  C:\Windows\System32\SndVol.exe
                  3⤵
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:1660
                  • C:\Windows\SysWOW64\SndVol.exe
                    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\emiy"
                    4⤵
                      PID:4348
                    • C:\Windows\SysWOW64\SndVol.exe
                      C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\emiy"
                      4⤵
                        PID:4440
                      • C:\Windows\SysWOW64\SndVol.exe
                        C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\emiy"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2892
                      • C:\Windows\SysWOW64\SndVol.exe
                        C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\ppnitxd"
                        4⤵
                          PID:1572
                        • C:\Windows\SysWOW64\SndVol.exe
                          C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\ppnitxd"
                          4⤵
                          • Accesses Microsoft Outlook accounts
                          • System Location Discovery: System Language Discovery
                          PID:1116
                        • C:\Windows\SysWOW64\SndVol.exe
                          C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\rjtbupnzxe"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3668
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:4796
                    • C:\Users\Public\alpha.exe
                      C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AHA.GIF" / A / F / Q / S
                      2⤵
                      • Executes dropped EXE
                      PID:2784

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\remcos\logs.dat

                    Filesize

                    222B

                    MD5

                    e8ac82413558862717d0c2c86eb86ef1

                    SHA1

                    0dfb235814745e6cd6c3ead4fe2f4a4278086ec0

                    SHA256

                    0717378fe2be81cfb2641e32892fb02d41fb93945aae9f4df90f48e2d9005675

                    SHA512

                    fc3916fb21c72f397bac4c02d96ef67b67f75471bd2c9e62f7fc98803dc50199ea55fecb54435577e819d4abe8a4acfb6faa1c7774b2f5ad629909bcfb79cb2e

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kxe1h5lt.okm.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\emiy

                    Filesize

                    4KB

                    MD5

                    faaa2b16df1bfc1a3792faaa35786349

                    SHA1

                    359534a59d7c5139ae205c24533ba60afdfb9f3f

                    SHA256

                    3586befc3b8b4da223e2ee0dcb00965ba5c0a205c14f2acefdeec7e46efddd5a

                    SHA512

                    2fbc79cace52a58e69ab983d034bb41ebb2496f767e18e5e4b31eefc4447c935d8614f744c71302e459350a05562fadc4c2355d76638b595e7cff1bb3d1618db

                  • C:\Users\Public\AHA.GIF

                    Filesize

                    4.2MB

                    MD5

                    2ddfa3ebd56847d40e59f092be0e6568

                    SHA1

                    3e56b1a986cd5600bc8dd134f1ff2ce5dbd53827

                    SHA256

                    11693a473afe426024135c37b1013491c2e98d89e6c9da6edfcc0a8c28bf1d02

                    SHA512

                    92816361505672a82452ed2036120a3d45e6abfa52577db819ba56318109da5242428bdf521751d6832976bc63831ddbaf0c10ad6563d26ed7b177f276421652

                  • C:\Users\Public\Libraries\AHA.COM

                    Filesize

                    1.2MB

                    MD5

                    d70fa5471771d18888f0861ac060a914

                    SHA1

                    83ef28ef9e4850629433f497fd0360120449e297

                    SHA256

                    31a7e70deb8af07d7b76b5dea8cbf90ec63bea24bffdd5ebac6f223c02f55753

                    SHA512

                    af89922e5a24a12522603e4a034b2e1aef911d5cf6399de426aa95b971dcf70513a99f45033895939f0475d7b001054717c9b0d38278ff45ee2b41376f3da31b

                  • C:\Users\Public\Libraries\jkzjblcW.cmd

                    Filesize

                    60KB

                    MD5

                    b87f096cbc25570329e2bb59fee57580

                    SHA1

                    d281d1bf37b4fb46f90973afc65eece3908532b2

                    SHA256

                    d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e

                    SHA512

                    72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7

                  • C:\Users\Public\alpha.exe

                    Filesize

                    283KB

                    MD5

                    8a2122e8162dbef04694b9c3e0b6cdee

                    SHA1

                    f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                    SHA256

                    b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                    SHA512

                    99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                  • C:\Users\Public\alpha.pif

                    Filesize

                    231KB

                    MD5

                    d0fce3afa6aa1d58ce9fa336cc2b675b

                    SHA1

                    4048488de6ba4bfef9edf103755519f1f762668f

                    SHA256

                    4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

                    SHA512

                    80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

                  • C:\Users\Public\kn.exe

                    Filesize

                    1.6MB

                    MD5

                    bd8d9943a9b1def98eb83e0fa48796c2

                    SHA1

                    70e89852f023ab7cde0173eda1208dbb580f1e4f

                    SHA256

                    8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

                    SHA512

                    95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

                  • C:\Users\Public\pha.pif

                    Filesize

                    442KB

                    MD5

                    04029e121a0cfa5991749937dd22a1d9

                    SHA1

                    f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                    SHA256

                    9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                    SHA512

                    6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                  • C:\Users\Public\xpha.pif

                    Filesize

                    18KB

                    MD5

                    b3624dd758ccecf93a1226cef252ca12

                    SHA1

                    fcf4dad8c4ad101504b1bf47cbbddbac36b558a7

                    SHA256

                    4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef

                    SHA512

                    c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

                  • C:\Windows \SysWOW64\NETUTILS.dll

                    Filesize

                    115KB

                    MD5

                    c5db31551cb21105e3f0b3e467b91cc7

                    SHA1

                    c66fd7732973d9803ba0fd4323e8507876892310

                    SHA256

                    3fa23d8f7b7eeac6443e107bd70d0c6371afc1f8082d3d58fffd8685cf9e2193

                    SHA512

                    6d1ee4b55fb74dc093f52caf1e093ec2742af263ff8fa264cd61eea48c021c3438150ba12a8e9d694e7246fe296ea011d8b6313e8ee4476a63c7072c2990685e

                  • C:\Windows \SysWOW64\per.exe

                    Filesize

                    94KB

                    MD5

                    869640d0a3f838694ab4dfea9e2f544d

                    SHA1

                    bdc42b280446ba53624ff23f314aadb861566832

                    SHA256

                    0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

                    SHA512

                    6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

                  • memory/1984-38-0x0000000000970000-0x0000000000980000-memory.dmp

                    Filesize

                    64KB

                  • memory/1984-61-0x0000000000D10000-0x0000000000D20000-memory.dmp

                    Filesize

                    64KB

                  • memory/2236-153-0x0000028AC5AC0000-0x0000028AC5AE2000-memory.dmp

                    Filesize

                    136KB

                  • memory/2364-31-0x0000000000400000-0x0000000000540000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2364-29-0x0000000002920000-0x0000000003920000-memory.dmp

                    Filesize

                    16.0MB

                  • memory/2364-28-0x0000000002920000-0x0000000003920000-memory.dmp

                    Filesize

                    16.0MB