Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 08:36

General

  • Target

    Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe

  • Size

    1.2MB

  • MD5

    d70fa5471771d18888f0861ac060a914

  • SHA1

    83ef28ef9e4850629433f497fd0360120449e297

  • SHA256

    31a7e70deb8af07d7b76b5dea8cbf90ec63bea24bffdd5ebac6f223c02f55753

  • SHA512

    af89922e5a24a12522603e4a034b2e1aef911d5cf6399de426aa95b971dcf70513a99f45033895939f0475d7b001054717c9b0d38278ff45ee2b41376f3da31b

  • SSDEEP

    24576:UMa3J1TbjIuI1OHXTXYYPajiFGoI3ajHucOWVQy/vrAFGSi29kQXY1Max2AnE:UMk27eayHaAnE

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\jkzjblcW.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Windows\SysWOW64\esentutl.exe
        C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
        3⤵
          PID:2456
        • C:\Windows\SysWOW64\esentutl.exe
          C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2568
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3432
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3932
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1360
          • C:\Users\Public\xpha.pif
            C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3192
        • C:\Windows \SysWOW64\per.exe
          "C:\\Windows \\SysWOW64\\per.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:3824
          • C:\Windows\SYSTEM32\esentutl.exe
            esentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o
            4⤵
              PID:728
            • C:\Users\Public\pha.pif
              C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'
              4⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3164
          • C:\Users\Public\alpha.pif
            C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1816
          • C:\Users\Public\alpha.pif
            C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4080
          • C:\Users\Public\alpha.pif
            C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4472
        • C:\Windows\SysWOW64\esentutl.exe
          C:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe /d C:\\Users\\Public\\Libraries\\Wclbjzkj.PIF /o
          2⤵
            PID:4904
          • C:\Windows\SysWOW64\colorcpl.exe
            C:\Windows\System32\colorcpl.exe
            2⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3532
            • C:\Windows\SysWOW64\colorcpl.exe
              C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\nzvtjehfyc"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4896
            • C:\Windows\SysWOW64\colorcpl.exe
              C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\xubmkxshmkiqc"
              3⤵
              • Accesses Microsoft Outlook accounts
              • System Location Discovery: System Language Discovery
              PID:3192
            • C:\Windows\SysWOW64\colorcpl.exe
              C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\awoekpdaasavmwovr"
              3⤵
                PID:4624
              • C:\Windows\SysWOW64\colorcpl.exe
                C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\awoekpdaasavmwovr"
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:536

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\remcos\logs.dat

            Filesize

            146B

            MD5

            476b0bc82c3d0201373a1ce713f1fccb

            SHA1

            31a21feac18297b427487b16f57489bbc5761b5e

            SHA256

            f148ab05d411137381cb20452316729e3abe646035fedc0c8fc6ad25797fcba1

            SHA512

            cab717eed38af22406b972c8dd0bef9d9e8682ea83e612f206dcebdafd39c89c83e7e94a54b35a5201100ec35e77e2cdd9a567e3bcee9b488b7f99f1768b0440

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nbkeqqm1.oxj.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\nzvtjehfyc

            Filesize

            4KB

            MD5

            8b8277c8f03c24d1f290dbe476e961d2

            SHA1

            2e13baf3a4b708277d550dc3dd1e0f99b131f78e

            SHA256

            9af6881f6dbffba028a7a977f4c0a43c764f840332986993ad66de7b816c2f9e

            SHA512

            7367a0236cd0d6cd731caf1ba1f4ea8f851ea1018a9c6b49db6e9d13b2aaba92767774da9169481918e4287021ff5c3a58c3143eaa5e7fe9fa88383208615948

          • C:\Users\Public\Libraries\jkzjblcW.cmd

            Filesize

            60KB

            MD5

            b87f096cbc25570329e2bb59fee57580

            SHA1

            d281d1bf37b4fb46f90973afc65eece3908532b2

            SHA256

            d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e

            SHA512

            72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7

          • C:\Users\Public\alpha.pif

            Filesize

            231KB

            MD5

            d0fce3afa6aa1d58ce9fa336cc2b675b

            SHA1

            4048488de6ba4bfef9edf103755519f1f762668f

            SHA256

            4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

            SHA512

            80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

          • C:\Users\Public\pha.pif

            Filesize

            442KB

            MD5

            04029e121a0cfa5991749937dd22a1d9

            SHA1

            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

            SHA256

            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

            SHA512

            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

          • C:\Users\Public\xpha.pif

            Filesize

            18KB

            MD5

            b3624dd758ccecf93a1226cef252ca12

            SHA1

            fcf4dad8c4ad101504b1bf47cbbddbac36b558a7

            SHA256

            4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef

            SHA512

            c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

          • C:\Windows \SysWOW64\NETUTILS.dll

            Filesize

            115KB

            MD5

            c5db31551cb21105e3f0b3e467b91cc7

            SHA1

            c66fd7732973d9803ba0fd4323e8507876892310

            SHA256

            3fa23d8f7b7eeac6443e107bd70d0c6371afc1f8082d3d58fffd8685cf9e2193

            SHA512

            6d1ee4b55fb74dc093f52caf1e093ec2742af263ff8fa264cd61eea48c021c3438150ba12a8e9d694e7246fe296ea011d8b6313e8ee4476a63c7072c2990685e

          • C:\Windows \SysWOW64\per.exe

            Filesize

            94KB

            MD5

            869640d0a3f838694ab4dfea9e2f544d

            SHA1

            bdc42b280446ba53624ff23f314aadb861566832

            SHA256

            0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

            SHA512

            6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

          • memory/2456-34-0x0000000001BD0000-0x0000000001BE0000-memory.dmp

            Filesize

            64KB

          • memory/2456-11-0x00000000017B0000-0x00000000017C0000-memory.dmp

            Filesize

            64KB

          • memory/3164-126-0x000001EB6F120000-0x000001EB6F142000-memory.dmp

            Filesize

            136KB

          • memory/3656-0-0x00000000007E0000-0x00000000007E1000-memory.dmp

            Filesize

            4KB

          • memory/3656-5-0x0000000000400000-0x0000000000540000-memory.dmp

            Filesize

            1.2MB

          • memory/3656-2-0x00000000028E0000-0x00000000038E0000-memory.dmp

            Filesize

            16.0MB

          • memory/3656-1-0x00000000028E0000-0x00000000038E0000-memory.dmp

            Filesize

            16.0MB