Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 05:57
General
-
Target
Payment Slip.xls
-
Size
413KB
-
MD5
5a788468cddd802e6eea249755b4beaf
-
SHA1
068f53461793d7859d33818369f2b89177767c00
-
SHA256
60a3ba978c54e5c55e3e41ae565ff05ba1e7fa9627a8bde0edb751aad25fa298
-
SHA512
a98e146b3725856522476969cef37e9144b36c434a990f60cde7675cdcf17aed430a63b2cc8a908c2a6030b4dbdfcc35c93d07adeaabef76fedcc828b1c3a5e2
-
SSDEEP
12288:/vGw7AQCRQwutWYRrBP5Eof77zUBoLiw:WwZHXtWiBPay7cBe
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 57 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Abuses OpenXML format to download file from external location 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Slip.xls"1⤵
- Abuses OpenXML format to download file from external location
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding1⤵
- Abuses OpenXML format to download file from external location
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\audiodg.exe"C:\Users\Admin\AppData\Roaming\audiodg.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 7083⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
Filesize
174B
MD580b69d3f31b79b5719b7a2c2ceba21db
SHA199bb8612c710b428ac9a3645fc1ab54e40c85f06
SHA256df3a559e8e881768d9387d1584cc12026c0f40b168df7efc3d2e5972ccddd2f0
SHA5121162ea6d22203b3f378fff35e2ab1982fffe7f48d0602d6060b0a345b0b74d6658a07230e312f55dc1a275dafaddbfda503fd1deda568639f8980b32a27d6115
-
Filesize
170B
MD5cafb8eebf458965c26f16ce7861acbb0
SHA10178c7a0411a293d67c04d2455290db693303531
SHA256f680aad5872fdcf0794976972da12695bcbf656992e1767ae3827c4d24f72255
SHA512f59b2db8312eee3a8a6e187f93ce92ce5db5915947d5847fb0762bfe4a715300ba1ceac5703fa109cf0ed81fb05538b4ed5f482e81231ac9e71d6ea1dc0f8dfb
-
Filesize
128KB
MD5c895e7eacac4407ef6a54070e19474d2
SHA11700b18e9994a623f5c25731b756be578d3956d6
SHA256a8aff47257ea77fcac0a190a0d0f2bcc829bc0d0498d8ae0dae9833249f62e25
SHA5126ca23dcb35ff1f854a0e3affa9101eea8216a055ec0c096cfcad26799d648d461c4912410430407e66785457c7b9ad062310aa91157e534dfb42b867d38eaaa3
-
Filesize
128KB
MD53bd8455a1d5c24e2a1aec9df26b3291c
SHA18efdfd22e388c896fb0b992b38f5b160c49cfa9d
SHA2560ba4e2347bd048b9e3f073a90d49156db6a41c474bcb7c7865998a6b7dcf750a
SHA5123055f2d4666722f6c8a04373e82021361a883f36abe72e2864c4bb7ff65b4406a628c01f41d3c29e97485bb5b3d8cf2e64cf96535814f5c896197cf3fbcb3346
-
Filesize
128KB
MD53ec32ecae173e8af5a34d67885ed467c
SHA1742737ab60927292267df13cb2cc5db4aa3bf815
SHA2561e4c71f650c2f7e2e2a8a015d0366a061d88538f4acb524c251d5cf2dd2fee68
SHA5123a4c853c0b2f754bb4344b966aa9b204a78f040f7da84030f1ff4b93dc15ea1c525f0fdda10154e1d26980fae6448350d93f7f8382f4851d8334c83910140d8a
-
Filesize
101KB
MD57a9a05109dd848058fd327bc38459a3d
SHA1a086488bd204ca42e9d522b769b94c9467ad5520
SHA2569f00a5fc9bdc5206d34d60f39e9872df590b4b71685afb0996e2d46e2b5a97d2
SHA5128dde56f67785f7594f1e4fe2a3b05519333daa980bae0fd84ffa34671d1d1f7507af6d04dba4909d3195db536ae2fd2782a6f45f5eb7f0df5015ca4b88e0925d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
128KB
MD52ab9bb406c3b31df91ea1c8592b00329
SHA1515c7e444b970e03427311da6d960cec92345105
SHA2564160cc5843da1e7314f52fa121157dbc9a83795908a77d125856e9bd039b5285
SHA512cc56adef2dffaafefe613279492190b6c4d35ad179245cb4eecea61b6f3c388dd3c2e0ccef46523f937b5ff92636e5421cb61ffcd37c1289ab90e485aece0bba
-
Filesize
1.0MB
MD5bbf710c83246092a538128620853d4fd
SHA195338f06c76178de31b5e8453f92c43f970ea9f9
SHA2567ad64f279e3fa6a7d0ef2916240f1337584c5b5176fb56089771164f2905554f
SHA512a609d92fe0d25e7db140c731af4b241d47cdaddfe735d9f7575c982ef790ab01d7f969038546e6054101b745e8c208f74e41faf246173ca0722c7b994cf94001
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
8KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
8KB
-
Filesize
44KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
1.1MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB