Analysis
-
max time kernel
39s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-09-2024 23:11
Static task
static1
Behavioral task
behavioral1
Sample
4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe
Resource
win10v2004-20240802-en
General
-
Target
4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe
-
Size
1.0MB
-
MD5
a7b12afe35112ee82d4bff29c6ccd3b0
-
SHA1
a47503ae304dda6ffa4439e61379b6f75d5d6ff5
-
SHA256
4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21
-
SHA512
148d9e7c46557866f2e9417beba2a27ec5996fe20da5c606a9824d234c78565beef6988ae63cdac6414a9aab5c458a5afbea83947417a193f2b14aa607672a19
-
SSDEEP
24576:P7rl+4eybvhO0kERedWIUwF42P17sLXcP7AIe5ocVVTNPYjxJ/WbBfU:P7xhqhWIbF4gKKeWcVVTNPYqfU
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2220-2-0x0000000003440000-0x0000000004440000-memory.dmp modiloader_stage2 -
Executes dropped EXE 10 IoCs
pid Process 3068 alpha.pif 2696 alpha.pif 2940 alpha.pif 2684 xpha.pif 2012 per.exe 2932 per.exe 2960 alpha.pif 788 alpha.pif 2540 alpha.pif 1680 lxsyrsiW.pif -
Loads dropped DLL 6 IoCs
pid Process 1484 cmd.exe 1484 cmd.exe 1484 cmd.exe 2940 alpha.pif 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wisrysxl = "C:\\Users\\Public\\Wisrysxl.url" 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 drive.google.com 4 drive.google.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2220 set thread context of 1680 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 45 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpha.pif -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1932 esentutl.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2220 wrote to memory of 1484 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 30 PID 2220 wrote to memory of 1484 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 30 PID 2220 wrote to memory of 1484 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 30 PID 2220 wrote to memory of 1484 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 30 PID 1484 wrote to memory of 2872 1484 cmd.exe 32 PID 1484 wrote to memory of 2872 1484 cmd.exe 32 PID 1484 wrote to memory of 2872 1484 cmd.exe 32 PID 1484 wrote to memory of 2872 1484 cmd.exe 32 PID 1484 wrote to memory of 1932 1484 cmd.exe 33 PID 1484 wrote to memory of 1932 1484 cmd.exe 33 PID 1484 wrote to memory of 1932 1484 cmd.exe 33 PID 1484 wrote to memory of 1932 1484 cmd.exe 33 PID 1484 wrote to memory of 3068 1484 cmd.exe 34 PID 1484 wrote to memory of 3068 1484 cmd.exe 34 PID 1484 wrote to memory of 3068 1484 cmd.exe 34 PID 1484 wrote to memory of 3068 1484 cmd.exe 34 PID 1484 wrote to memory of 2696 1484 cmd.exe 35 PID 1484 wrote to memory of 2696 1484 cmd.exe 35 PID 1484 wrote to memory of 2696 1484 cmd.exe 35 PID 1484 wrote to memory of 2696 1484 cmd.exe 35 PID 1484 wrote to memory of 2940 1484 cmd.exe 36 PID 1484 wrote to memory of 2940 1484 cmd.exe 36 PID 1484 wrote to memory of 2940 1484 cmd.exe 36 PID 1484 wrote to memory of 2940 1484 cmd.exe 36 PID 2940 wrote to memory of 2684 2940 alpha.pif 37 PID 2940 wrote to memory of 2684 2940 alpha.pif 37 PID 2940 wrote to memory of 2684 2940 alpha.pif 37 PID 2940 wrote to memory of 2684 2940 alpha.pif 37 PID 1484 wrote to memory of 2960 1484 cmd.exe 40 PID 1484 wrote to memory of 2960 1484 cmd.exe 40 PID 1484 wrote to memory of 2960 1484 cmd.exe 40 PID 1484 wrote to memory of 2960 1484 cmd.exe 40 PID 1484 wrote to memory of 788 1484 cmd.exe 41 PID 1484 wrote to memory of 788 1484 cmd.exe 41 PID 1484 wrote to memory of 788 1484 cmd.exe 41 PID 1484 wrote to memory of 788 1484 cmd.exe 41 PID 1484 wrote to memory of 2540 1484 cmd.exe 42 PID 1484 wrote to memory of 2540 1484 cmd.exe 42 PID 1484 wrote to memory of 2540 1484 cmd.exe 42 PID 1484 wrote to memory of 2540 1484 cmd.exe 42 PID 2220 wrote to memory of 2044 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 43 PID 2220 wrote to memory of 2044 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 43 PID 2220 wrote to memory of 2044 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 43 PID 2220 wrote to memory of 2044 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 43 PID 2220 wrote to memory of 1680 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 45 PID 2220 wrote to memory of 1680 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 45 PID 2220 wrote to memory of 1680 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 45 PID 2220 wrote to memory of 1680 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 45 PID 2220 wrote to memory of 1680 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 45 PID 2220 wrote to memory of 1680 2220 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe"C:\Users\Admin\AppData\Local\Temp\4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o3⤵PID:2872
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1932
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2696
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 103⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 104⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684
-
-
-
C:\Windows \SysWOW64\per.exe"C:\\Windows \\SysWOW64\\per.exe3⤵
- Executes dropped EXE
PID:2012
-
-
C:\Windows \SysWOW64\per.exe"C:\Windows \SysWOW64\per.exe"3⤵
- Executes dropped EXE
PID:2932
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW643⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:788
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2540
-
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o2⤵PID:2044
-
-
C:\Users\Public\Libraries\lxsyrsiW.pifC:\Users\Public\Libraries\lxsyrsiW.pif2⤵
- Executes dropped EXE
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5b87f096cbc25570329e2bb59fee57580
SHA1d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA51272901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
-
Filesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7
-
Filesize
66KB
MD5c116d3604ceafe7057d77ff27552c215
SHA1452b14432fb5758b46f2897aeccd89f7c82a727d
SHA2567bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA5129202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
-
Filesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1
-
Filesize
15KB
MD56242e3d67787ccbf4e06ad2982853144
SHA16ac7947207d999a65890ab25fe344955da35028e
SHA2564ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d
SHA5127d0d457e1537d624119a8023bcc086575696a5739c0460ef11554afac13af5e5d1edc7629a10e62834aba9f1b3ab1442011b15b4c3930399d91dca34b3b1cbaf