Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-09-2024 09:06
Behavioral task
behavioral1
Sample
7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe
Resource
win10v2004-20240802-en
General
-
Target
7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe
-
Size
90KB
-
MD5
05a6b431752ae17128c7b12127178350
-
SHA1
3fb5daa48f9819dd304a403952b8d0a83134c1e0
-
SHA256
7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71
-
SHA512
a50925ff25f8d89a155e3e8ca56acc9d4565943b6df8b14d10c5146c35bf437f41997c4252e71edc42d075fb0923f402de000488c9b5f2a8cb2d28a3bd28e73a
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/884-247-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/884-258-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
pid Process 860 csrsll.exe 752 csrsll.exe 884 csrsll.exe -
Loads dropped DLL 5 IoCs
pid Process 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe -
resource yara_rule behavioral1/memory/2624-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2624-26-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2624-89-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/848-95-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/848-104-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/848-106-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/848-103-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2624-102-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/848-99-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/848-93-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a0000000120f9-131.dat upx behavioral1/memory/848-145-0x00000000034A0000-0x00000000034F3000-memory.dmp upx behavioral1/memory/860-147-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/848-150-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/860-209-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/848-193-0x00000000034A0000-0x00000000034F3000-memory.dmp upx behavioral1/memory/848-238-0x00000000034A0000-0x00000000034F3000-memory.dmp upx behavioral1/memory/884-247-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/860-249-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/848-254-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/752-255-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/884-258-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2624 set thread context of 848 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 30 PID 860 set thread context of 752 860 csrsll.exe 35 PID 860 set thread context of 884 860 csrsll.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe Token: SeDebugPrivilege 752 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 860 csrsll.exe 752 csrsll.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2624 wrote to memory of 848 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 30 PID 2624 wrote to memory of 848 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 30 PID 2624 wrote to memory of 848 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 30 PID 2624 wrote to memory of 848 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 30 PID 2624 wrote to memory of 848 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 30 PID 2624 wrote to memory of 848 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 30 PID 2624 wrote to memory of 848 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 30 PID 2624 wrote to memory of 848 2624 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 30 PID 848 wrote to memory of 3036 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 31 PID 848 wrote to memory of 3036 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 31 PID 848 wrote to memory of 3036 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 31 PID 848 wrote to memory of 3036 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 31 PID 3036 wrote to memory of 620 3036 cmd.exe 33 PID 3036 wrote to memory of 620 3036 cmd.exe 33 PID 3036 wrote to memory of 620 3036 cmd.exe 33 PID 3036 wrote to memory of 620 3036 cmd.exe 33 PID 848 wrote to memory of 860 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 34 PID 848 wrote to memory of 860 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 34 PID 848 wrote to memory of 860 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 34 PID 848 wrote to memory of 860 848 7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe 34 PID 860 wrote to memory of 752 860 csrsll.exe 35 PID 860 wrote to memory of 752 860 csrsll.exe 35 PID 860 wrote to memory of 752 860 csrsll.exe 35 PID 860 wrote to memory of 752 860 csrsll.exe 35 PID 860 wrote to memory of 752 860 csrsll.exe 35 PID 860 wrote to memory of 752 860 csrsll.exe 35 PID 860 wrote to memory of 752 860 csrsll.exe 35 PID 860 wrote to memory of 752 860 csrsll.exe 35 PID 860 wrote to memory of 884 860 csrsll.exe 36 PID 860 wrote to memory of 884 860 csrsll.exe 36 PID 860 wrote to memory of 884 860 csrsll.exe 36 PID 860 wrote to memory of 884 860 csrsll.exe 36 PID 860 wrote to memory of 884 860 csrsll.exe 36 PID 860 wrote to memory of 884 860 csrsll.exe 36 PID 860 wrote to memory of 884 860 csrsll.exe 36 PID 860 wrote to memory of 884 860 csrsll.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe"C:\Users\Admin\AppData\Local\Temp\7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe"C:\Users\Admin\AppData\Local\Temp\7729063170662155c245524d40ed73cdb67a4b0aa7c504331c5fba523df77d71N.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\QVHFJ.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:620
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:752
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:884
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
90KB
MD5e82db6f7950ec054e75801ee4b5d0469
SHA1bf7cf06b2f6043870c00e7ee8ddda60875201f1f
SHA25644cbe0b0c8916b7d702fd525c57213c9892aaa5ab702ecbad6eac4ca47e2e14c
SHA512f66c85f8fdead0c6c63e754523dfa44f885b7685ac6433ec1823933fc2aa7c2afcd314b4f5e039347ed1f917c47c4a2b286ad460e3b5021f31449c871d9b36f6