Analysis

  • max time kernel
    144s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2024 01:37

General

  • Target

    eb0786d23a2ada26a937a41d56a96514a3df0027ff857d0407d462adfba18ddb.rtf

  • Size

    78KB

  • MD5

    d63c7600ca42fe65af91ae662ef7b637

  • SHA1

    6f8bba7b9751ed550d0bd7f6f29e7229888ad6f9

  • SHA256

    eb0786d23a2ada26a937a41d56a96514a3df0027ff857d0407d462adfba18ddb

  • SHA512

    83f20a16b336f08d817bc427b39a62a0957ec4bf481b10a320e184c378e227fc2bae513245a18c056fdd34e53f0e6b192f6ca2cb16ad0ca123fdd2938dd58427

  • SSDEEP

    384:vnHdoOarkwlJbmbKLY17V/W7ZftG5eqVdwRQb65Y2zdfGxswDRa:vnHmOarkwTzs174geqVCFux7a

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 60 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\eb0786d23a2ada26a937a41d56a96514a3df0027ff857d0407d462adfba18ddb.rtf"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2776
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Roaming\audiodg.exe
        "C:\Users\Admin\AppData\Roaming\audiodg.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 748
          3⤵
          • Loads dropped DLL
          • Program crash
          PID:1496

    Network

    • flag-us
      GET
      http://107.175.243.142/254/audiodg.exe
      EQNEDT32.EXE
      Remote address:
      107.175.243.142:80
      Request
      GET /254/audiodg.exe HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: 107.175.243.142
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Mon, 23 Sep 2024 01:37:04 GMT
      Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
      Last-Modified: Thu, 12 Sep 2024 05:32:53 GMT
      ETag: "19d000-621e570328fe3"
      Accept-Ranges: bytes
      Content-Length: 1691648
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Content-Type: application/lnk
    • flag-us
      DNS
      maan2u.com
      audiodg.exe
      Remote address:
      8.8.8.8:53
      Request
      maan2u.com
      IN A
      Response
      maan2u.com
      IN A
      112.137.173.77
    • 107.175.243.142:80
      http://107.175.243.142/254/audiodg.exe
      http
      EQNEDT32.EXE
      42.2kB
      1.7MB
      857
      1260

      HTTP Request

      GET http://107.175.243.142/254/audiodg.exe

      HTTP Response

      200
    • 112.137.173.77:443
      maan2u.com
      audiodg.exe
      190 B
      92 B
      4
      2
    • 112.137.173.77:443
      maan2u.com
      tls
      audiodg.exe
      344 B
      219 B
      5
      5
    • 112.137.173.77:443
      maan2u.com
      tls
      audiodg.exe
      288 B
      219 B
      5
      5
    • 8.8.8.8:53
      maan2u.com
      dns
      audiodg.exe
      56 B
      72 B
      1
      1

      DNS Request

      maan2u.com

      DNS Response

      112.137.173.77

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      acec6ef82a478b45a9d699ce4cbb515c

      SHA1

      32a804b7f1a8530ffabeb8a8c518f752ea77c657

      SHA256

      0b99b09e61f842069b6a665d36c40389d362ed9f368ecb8dd2e2c1b9fef3fed1

      SHA512

      c77436668bfd27a4eddb857ad0733ab842271047fbbd3d061233ca66d4a17cfd5d0fda19d552dcf725fa54188f8662a0baaca1b3694b45c8ff68c9225da42e33

    • C:\Users\Admin\AppData\Roaming\audiodg.exe

      Filesize

      1.6MB

      MD5

      d2d166937422f379e6dd15041d83af21

      SHA1

      84e0e1e9371b52e6682303fc11b02b69a3df782d

      SHA256

      c59da5938f667c04ca2ba3639b6cb3d5813fc189d4b2f412613b4bfa36ae0664

      SHA512

      3eb977c92a6a541bafd8f5c70d6263c21be019e6124efecb5bd237cbdd24d02eb150f08c9c1bbd3e54a54ef817041a293b03d63d15ec54f18eaa10f888adf8cf

    • memory/2700-89-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-59-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-29-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-18-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-31-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-109-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-107-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-70-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-69-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-67-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-65-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-64-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-61-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-87-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-57-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-55-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-54-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-51-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-49-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-47-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-46-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-44-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-43-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-41-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-105-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-39-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-102-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-99-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-97-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-38-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-85-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-92-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-78-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-27-0x0000000000400000-0x00000000005A8000-memory.dmp

      Filesize

      1.7MB

    • memory/2700-94-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-83-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-81-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-20-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-75-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-73-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-71-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-35-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-68-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-66-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-63-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-62-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-60-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-58-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-56-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-53-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-52-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-50-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-48-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-45-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-42-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-30-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-32-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-40-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-37-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-36-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-34-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2700-33-0x0000000003680000-0x0000000004680000-memory.dmp

      Filesize

      16.0MB

    • memory/2796-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2796-0-0x000000002F081000-0x000000002F082000-memory.dmp

      Filesize

      4KB

    • memory/2796-2-0x000000007102D000-0x0000000071038000-memory.dmp

      Filesize

      44KB

    • memory/2796-25-0x000000007102D000-0x0000000071038000-memory.dmp

      Filesize

      44KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.