Analysis

  • max time kernel
    134s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 09:37

General

  • Target

    ORDERREF47806798PSMCO.exe

  • Size

    1.0MB

  • MD5

    0c30c6e44c595afef7d8e5209e6c21cd

  • SHA1

    9ad384a291bcb187a770826c9b4524ded9d4ce33

  • SHA256

    76af8cf5846c6addfc9049cde063bbee8c0353bc0870c5080ad37a41a9aab1a3

  • SHA512

    2ecd6746865cb88457f3e60445fbb5a790a9df84ca1d00acdd5124eea986e17e61d2dbe6b236d7b40691c7ff3a2f473508bb7b4299575b14b6124e64b905d543

  • SSDEEP

    24576:ZVb5KPAdOzVmG3zd+eIDT8Jf3pbV13Jks:ZVhOhd+eI8t5X

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 61 IoCs
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ORDERREF47806798PSMCO.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDERREF47806798PSMCO.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\jpyzkpiZ.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Windows\SysWOW64\esentutl.exe
        C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
        3⤵
          PID:1296
        • C:\Windows\SysWOW64\esentutl.exe
          C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3552
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2236
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4320
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4748
          • C:\Users\Public\xpha.pif
            C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2328
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4224
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1464
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3784
      • C:\Windows\SysWOW64\esentutl.exe
        C:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\ORDERREF47806798PSMCO.exe /d C:\\Users\\Public\\Libraries\\Zipkzypj.PIF /o
        2⤵
          PID:4932
        • C:\Users\Public\Libraries\jpyzkpiZ.pif
          C:\Users\Public\Libraries\jpyzkpiZ.pif
          2⤵
          • Executes dropped EXE
          PID:4548
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 12
            3⤵
            • Program crash
            PID:4740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4548 -ip 4548
        1⤵
          PID:3128

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Public\Libraries\jpyzkpiZ.cmd

                Filesize

                60KB

                MD5

                b87f096cbc25570329e2bb59fee57580

                SHA1

                d281d1bf37b4fb46f90973afc65eece3908532b2

                SHA256

                d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e

                SHA512

                72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7

              • C:\Users\Public\Libraries\jpyzkpiZ.pif

                Filesize

                66KB

                MD5

                c116d3604ceafe7057d77ff27552c215

                SHA1

                452b14432fb5758b46f2897aeccd89f7c82a727d

                SHA256

                7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

                SHA512

                9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

              • C:\Users\Public\alpha.pif

                Filesize

                231KB

                MD5

                d0fce3afa6aa1d58ce9fa336cc2b675b

                SHA1

                4048488de6ba4bfef9edf103755519f1f762668f

                SHA256

                4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

                SHA512

                80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

              • C:\Users\Public\xpha.pif

                Filesize

                18KB

                MD5

                b3624dd758ccecf93a1226cef252ca12

                SHA1

                fcf4dad8c4ad101504b1bf47cbbddbac36b558a7

                SHA256

                4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef

                SHA512

                c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

              • memory/2420-0-0x00000000006F0000-0x00000000006F1000-memory.dmp

                Filesize

                4KB

              • memory/2420-1-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-2-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-5-0x00000000006F0000-0x00000000006F1000-memory.dmp

                Filesize

                4KB

              • memory/2420-4-0x0000000000400000-0x000000000050A000-memory.dmp

                Filesize

                1.0MB

              • memory/2420-10-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-9-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-8-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-14-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-38-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-22-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-37-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-25-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-42-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-24-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-41-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-40-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-39-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-23-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-34-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-61-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-32-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-58-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-31-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-30-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-54-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-18-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-50-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-29-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-27-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-45-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-15-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-21-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-36-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-35-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-13-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-20-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-33-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-19-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-12-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-17-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-11-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-16-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-7-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-63-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-66-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-65-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-64-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-62-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-60-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-59-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-57-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-56-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-55-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-53-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-52-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-51-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-28-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-49-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-48-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-47-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-46-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-26-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-44-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB

              • memory/2420-43-0x0000000002C30000-0x0000000003C30000-memory.dmp

                Filesize

                16.0MB