Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2024 12:12
Behavioral task
behavioral1
Sample
f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe
Resource
win10v2004-20241007-en
General
-
Target
f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe
-
Size
90KB
-
MD5
43e97117bfade5aa4c5614aaf9a7ad80
-
SHA1
42b98fea6bc225bb7941d49bcaf2fb23c8d83c3b
-
SHA256
f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96
-
SHA512
5a2009d430089fb8af7a1d7367c400a4a2ca092908e02b157d8bbf938a139e5c2b7e8b45ff0619da5c790b2285f69232889a2bb89dbffee97c1b178fab39f3ca
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4828-55-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4828-56-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4828-53-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4828-63-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid Process 744 csrsll.exe 4964 csrsll.exe 4828 csrsll.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.execsrsll.exedescription pid Process procid_target PID 2312 set thread context of 3652 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 91 PID 744 set thread context of 4964 744 csrsll.exe 99 PID 744 set thread context of 4828 744 csrsll.exe 100 -
Processes:
resource yara_rule behavioral2/memory/2312-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2312-5-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3652-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3652-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2312-11-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3652-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0010000000023b24-29.dat upx behavioral2/memory/744-36-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3652-40-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/744-41-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/744-42-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4828-51-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4828-46-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4828-55-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4828-56-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/744-58-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4828-53-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3652-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4964-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4828-63-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exereg.execsrsll.execsrsll.execsrsll.exef709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exef709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid Process Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe Token: SeDebugPrivilege 4964 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exef709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.execsrsll.execsrsll.exepid Process 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 3652 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 744 csrsll.exe 4964 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exef709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.execmd.execsrsll.exedescription pid Process procid_target PID 2312 wrote to memory of 3652 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 91 PID 2312 wrote to memory of 3652 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 91 PID 2312 wrote to memory of 3652 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 91 PID 2312 wrote to memory of 3652 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 91 PID 2312 wrote to memory of 3652 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 91 PID 2312 wrote to memory of 3652 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 91 PID 2312 wrote to memory of 3652 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 91 PID 2312 wrote to memory of 3652 2312 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 91 PID 3652 wrote to memory of 3580 3652 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 92 PID 3652 wrote to memory of 3580 3652 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 92 PID 3652 wrote to memory of 3580 3652 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 92 PID 3580 wrote to memory of 4132 3580 cmd.exe 95 PID 3580 wrote to memory of 4132 3580 cmd.exe 95 PID 3580 wrote to memory of 4132 3580 cmd.exe 95 PID 3652 wrote to memory of 744 3652 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 96 PID 3652 wrote to memory of 744 3652 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 96 PID 3652 wrote to memory of 744 3652 f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe 96 PID 744 wrote to memory of 4964 744 csrsll.exe 99 PID 744 wrote to memory of 4964 744 csrsll.exe 99 PID 744 wrote to memory of 4964 744 csrsll.exe 99 PID 744 wrote to memory of 4964 744 csrsll.exe 99 PID 744 wrote to memory of 4964 744 csrsll.exe 99 PID 744 wrote to memory of 4964 744 csrsll.exe 99 PID 744 wrote to memory of 4964 744 csrsll.exe 99 PID 744 wrote to memory of 4964 744 csrsll.exe 99 PID 744 wrote to memory of 4828 744 csrsll.exe 100 PID 744 wrote to memory of 4828 744 csrsll.exe 100 PID 744 wrote to memory of 4828 744 csrsll.exe 100 PID 744 wrote to memory of 4828 744 csrsll.exe 100 PID 744 wrote to memory of 4828 744 csrsll.exe 100 PID 744 wrote to memory of 4828 744 csrsll.exe 100 PID 744 wrote to memory of 4828 744 csrsll.exe 100 PID 744 wrote to memory of 4828 744 csrsll.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe"C:\Users\Admin\AppData\Local\Temp\f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe"C:\Users\Admin\AppData\Local\Temp\f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QCINB.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4132
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4964
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4828
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
90KB
MD5a7781a805bb36f9fa35a1a2ec69f9869
SHA128516b17c1bf87996fe4aba0e7c828a5c1269986
SHA256e5d571c3ae16eeeebfd9eb09f248f87e866389dd877a29a31f8517f4c22604d2
SHA512fc4376e9849a10ccf1cc3acf0602586001a21f0494e4e1a20c1290240f2b525e48f2e0aacac298cabdfa0187f88d93031f52fcb764157be7b36e01f2e684e44d