Analysis
-
max time kernel
17s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 21:55
Static task
static1
Behavioral task
behavioral1
Sample
1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe
Resource
win10v2004-20240802-en
General
-
Target
1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe
-
Size
112KB
-
MD5
3555e501530260e4d1c0435b486dc374
-
SHA1
e92110342c9042e18296c6e29bcd99c8be8dcdfd
-
SHA256
1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647
-
SHA512
c2855d711959da2cea292566cad4e6a642150f193d684f9eb86b35b7a9d30806ee1aa1c4f87ea2346068ba130bebf5c620a5f8b33d5b9ef356c37f6b8c98e9a6
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/1692-290-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
pid Process 2664 WAMain.exe 940 WAMain.exe 1692 WAMain.exe -
Loads dropped DLL 5 IoCs
pid Process 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2056 set thread context of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 set thread context of 3048 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 31 PID 2664 set thread context of 1704 2664 WAMain.exe 36 PID 2664 set thread context of 940 2664 WAMain.exe 37 PID 2664 set thread context of 1692 2664 WAMain.exe 38 -
resource yara_rule behavioral1/memory/3048-128-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3048-124-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3048-123-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3048-116-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3048-112-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3048-109-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1692-273-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/3048-285-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/940-289-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1692-290-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe 2648 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 940 WAMain.exe Token: SeDebugPrivilege 940 WAMain.exe Token: SeDebugPrivilege 940 WAMain.exe Token: SeDebugPrivilege 940 WAMain.exe Token: SeDebugPrivilege 940 WAMain.exe Token: SeDebugPrivilege 940 WAMain.exe Token: SeDebugPrivilege 940 WAMain.exe Token: SeDebugPrivilege 940 WAMain.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 2648 svchost.exe 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 2664 WAMain.exe 1704 svchost.exe 940 WAMain.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 2648 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 30 PID 2056 wrote to memory of 3048 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 31 PID 2056 wrote to memory of 3048 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 31 PID 2056 wrote to memory of 3048 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 31 PID 2056 wrote to memory of 3048 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 31 PID 2056 wrote to memory of 3048 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 31 PID 2056 wrote to memory of 3048 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 31 PID 2056 wrote to memory of 3048 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 31 PID 2056 wrote to memory of 3048 2056 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 31 PID 3048 wrote to memory of 492 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 32 PID 3048 wrote to memory of 492 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 32 PID 3048 wrote to memory of 492 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 32 PID 3048 wrote to memory of 492 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 32 PID 492 wrote to memory of 2088 492 cmd.exe 34 PID 492 wrote to memory of 2088 492 cmd.exe 34 PID 492 wrote to memory of 2088 492 cmd.exe 34 PID 492 wrote to memory of 2088 492 cmd.exe 34 PID 3048 wrote to memory of 2664 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 35 PID 3048 wrote to memory of 2664 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 35 PID 3048 wrote to memory of 2664 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 35 PID 3048 wrote to memory of 2664 3048 1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe 35 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 1704 2664 WAMain.exe 36 PID 2664 wrote to memory of 940 2664 WAMain.exe 37 PID 2664 wrote to memory of 940 2664 WAMain.exe 37 PID 2664 wrote to memory of 940 2664 WAMain.exe 37 PID 2664 wrote to memory of 940 2664 WAMain.exe 37 PID 2664 wrote to memory of 940 2664 WAMain.exe 37 PID 2664 wrote to memory of 940 2664 WAMain.exe 37 PID 2664 wrote to memory of 940 2664 WAMain.exe 37 PID 2664 wrote to memory of 940 2664 WAMain.exe 37 PID 2664 wrote to memory of 1692 2664 WAMain.exe 38 PID 2664 wrote to memory of 1692 2664 WAMain.exe 38 PID 2664 wrote to memory of 1692 2664 WAMain.exe 38 PID 2664 wrote to memory of 1692 2664 WAMain.exe 38 PID 2664 wrote to memory of 1692 2664 WAMain.exe 38 PID 2664 wrote to memory of 1692 2664 WAMain.exe 38 PID 2664 wrote to memory of 1692 2664 WAMain.exe 38 PID 2664 wrote to memory of 1692 2664 WAMain.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe"C:\Users\Admin\AppData\Local\Temp\1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
C:\Users\Admin\AppData\Local\Temp\1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe"C:\Users\Admin\AppData\Local\Temp\1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\UGOFX.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2088
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:940
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1692
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD50bd874fc4b4830dd2b32952722be09a9
SHA1de783e43a0bc51784d688fd7433848894d1c6efa
SHA256b4f955556a520e9be9ba23386e39399fb3727b66ca1a6d59b55da88292f09cd1
SHA512d2f13cc1b60d72e80355e0e02e2e90420f729887a4516ca7ef6b9947490190878cf3309bb35c9d0af02513972022c682b22bfb13d34a190d0ffccaa5aa8fd754