Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 05:11
Static task
static1
Behavioral task
behavioral1
Sample
021020240151x.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
021020240151x.exe
Resource
win10v2004-20240802-en
General
-
Target
021020240151x.exe
-
Size
1.1MB
-
MD5
4ddb14680584c0546ccbc70b8d0411c4
-
SHA1
1ff45158480cc901c99079f02b82d4a40163be7a
-
SHA256
1d8968fc899fd0ccb7737c1019808f034eb86e7c55359681f7e51cf1982ba07e
-
SHA512
18542630cb735f45b0cf8bf9f7b64bcb6110dc21e94e83bd25007afc6a2677660ba46ff2c83c0c040c4bf8fb3d22f30089dee655822313f6d72b1f75fb8d2d4d
-
SSDEEP
24576:cBMP2iSAAicPschqrDG3oxxRa/hoKg97y4zuaRacKHT:cOP+wm3Aihg9XzuaRe
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral1/memory/596-2-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-5-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-6-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-7-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-9-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-12-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-14-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-17-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-21-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-26-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-29-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-34-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-37-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-42-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-44-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-48-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-51-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-55-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-58-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-61-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-64-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-67-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-71-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-8-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-77-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-80-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-83-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-15-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-20-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-32-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-38-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-46-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-54-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-56-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-53-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-52-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-50-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-49-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-47-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-45-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-43-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-41-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-40-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-39-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-36-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-35-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-33-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-31-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-30-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-28-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-27-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-25-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-24-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-23-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-22-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-19-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-18-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-16-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-13-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-11-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 behavioral1/memory/596-10-0x00000000035A0000-0x00000000045A0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 10 IoCs
pid Process 380 alpha.pif 2388 alpha.pif 348 alpha.pif 1732 xpha.pif 1232 per.exe 1916 per.exe 1624 alpha.pif 1944 alpha.pif 912 alpha.pif 3068 lxsyrsiW.pif -
Loads dropped DLL 6 IoCs
pid Process 1940 cmd.exe 1940 cmd.exe 1940 cmd.exe 348 alpha.pif 596 021020240151x.exe 596 021020240151x.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wisrysxl = "C:\\Users\\Public\\Wisrysxl.url" 021020240151x.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 drive.google.com 4 drive.google.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 596 set thread context of 3068 596 021020240151x.exe 45 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 021020240151x.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpha.pif -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2380 esentutl.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 596 wrote to memory of 1940 596 021020240151x.exe 31 PID 596 wrote to memory of 1940 596 021020240151x.exe 31 PID 596 wrote to memory of 1940 596 021020240151x.exe 31 PID 596 wrote to memory of 1940 596 021020240151x.exe 31 PID 1940 wrote to memory of 2280 1940 cmd.exe 33 PID 1940 wrote to memory of 2280 1940 cmd.exe 33 PID 1940 wrote to memory of 2280 1940 cmd.exe 33 PID 1940 wrote to memory of 2280 1940 cmd.exe 33 PID 1940 wrote to memory of 2380 1940 cmd.exe 34 PID 1940 wrote to memory of 2380 1940 cmd.exe 34 PID 1940 wrote to memory of 2380 1940 cmd.exe 34 PID 1940 wrote to memory of 2380 1940 cmd.exe 34 PID 1940 wrote to memory of 380 1940 cmd.exe 35 PID 1940 wrote to memory of 380 1940 cmd.exe 35 PID 1940 wrote to memory of 380 1940 cmd.exe 35 PID 1940 wrote to memory of 380 1940 cmd.exe 35 PID 1940 wrote to memory of 2388 1940 cmd.exe 36 PID 1940 wrote to memory of 2388 1940 cmd.exe 36 PID 1940 wrote to memory of 2388 1940 cmd.exe 36 PID 1940 wrote to memory of 2388 1940 cmd.exe 36 PID 1940 wrote to memory of 348 1940 cmd.exe 37 PID 1940 wrote to memory of 348 1940 cmd.exe 37 PID 1940 wrote to memory of 348 1940 cmd.exe 37 PID 1940 wrote to memory of 348 1940 cmd.exe 37 PID 348 wrote to memory of 1732 348 alpha.pif 38 PID 348 wrote to memory of 1732 348 alpha.pif 38 PID 348 wrote to memory of 1732 348 alpha.pif 38 PID 348 wrote to memory of 1732 348 alpha.pif 38 PID 1940 wrote to memory of 1624 1940 cmd.exe 41 PID 1940 wrote to memory of 1624 1940 cmd.exe 41 PID 1940 wrote to memory of 1624 1940 cmd.exe 41 PID 1940 wrote to memory of 1624 1940 cmd.exe 41 PID 1940 wrote to memory of 1944 1940 cmd.exe 42 PID 1940 wrote to memory of 1944 1940 cmd.exe 42 PID 1940 wrote to memory of 1944 1940 cmd.exe 42 PID 1940 wrote to memory of 1944 1940 cmd.exe 42 PID 1940 wrote to memory of 912 1940 cmd.exe 43 PID 1940 wrote to memory of 912 1940 cmd.exe 43 PID 1940 wrote to memory of 912 1940 cmd.exe 43 PID 1940 wrote to memory of 912 1940 cmd.exe 43 PID 596 wrote to memory of 852 596 021020240151x.exe 44 PID 596 wrote to memory of 852 596 021020240151x.exe 44 PID 596 wrote to memory of 852 596 021020240151x.exe 44 PID 596 wrote to memory of 852 596 021020240151x.exe 44 PID 596 wrote to memory of 3068 596 021020240151x.exe 45 PID 596 wrote to memory of 3068 596 021020240151x.exe 45 PID 596 wrote to memory of 3068 596 021020240151x.exe 45 PID 596 wrote to memory of 3068 596 021020240151x.exe 45 PID 596 wrote to memory of 3068 596 021020240151x.exe 45 PID 596 wrote to memory of 3068 596 021020240151x.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\021020240151x.exe"C:\Users\Admin\AppData\Local\Temp\021020240151x.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o3⤵PID:2280
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2380
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:380
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2388
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 103⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 104⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1732
-
-
-
C:\Windows \SysWOW64\per.exe"C:\\Windows \\SysWOW64\\per.exe3⤵
- Executes dropped EXE
PID:1232
-
-
C:\Windows \SysWOW64\per.exe"C:\Windows \SysWOW64\per.exe"3⤵
- Executes dropped EXE
PID:1916
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1624
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW643⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:912
-
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\021020240151x.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o2⤵PID:852
-
-
C:\Users\Public\Libraries\lxsyrsiW.pifC:\Users\Public\Libraries\lxsyrsiW.pif2⤵
- Executes dropped EXE
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5b87f096cbc25570329e2bb59fee57580
SHA1d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA51272901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
-
Filesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1
-
Filesize
15KB
MD56242e3d67787ccbf4e06ad2982853144
SHA16ac7947207d999a65890ab25fe344955da35028e
SHA2564ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d
SHA5127d0d457e1537d624119a8023bcc086575696a5739c0460ef11554afac13af5e5d1edc7629a10e62834aba9f1b3ab1442011b15b4c3930399d91dca34b3b1cbaf
-
Filesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7
-
Filesize
66KB
MD5c116d3604ceafe7057d77ff27552c215
SHA1452b14432fb5758b46f2897aeccd89f7c82a727d
SHA2567bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA5129202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6