Analysis
-
max time kernel
102s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 18:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PaymentDetails.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
PaymentDetails.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
PaymentDetails.exe
-
Size
1.5MB
-
MD5
8829ac95079c711f9f7ecde3f8a47e65
-
SHA1
c0c601ca0d59d4776b0bf22bf1a3cce319011747
-
SHA256
a6097c984268c1d8031f5530890323c4007796d8d3edf386676e9322f0a71173
-
SHA512
390bfc3b8f85a0c0f14fd608deff2c314f3814de1829cbbc3910bdf97a37bef199a94ae8af9a12eb1220d44dc423cae4ef34ffd6f6ecca12ede092401d8234b9
-
SSDEEP
24576:RWGddPN4jN35Ohf8aT7JYR/MNPjWXY1Q7/VJJzsaz:RLLW15OOIYR/wjWXY1QZNz
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/4300-2-0x0000000002F40000-0x0000000003F40000-memory.dmp modiloader_stage2 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PaymentDetails.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SndVol.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4300 PaymentDetails.exe 4300 PaymentDetails.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe 4112 SndVol.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4112 SndVol.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4112 SndVol.exe 4112 SndVol.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe PID 4300 wrote to memory of 0 4300 PaymentDetails.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PaymentDetails.exe"C:\Users\Admin\AppData\Local\Temp\PaymentDetails.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4112
-