Analysis
-
max time kernel
150s -
max time network
272s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 00:25
Static task
static1
Behavioral task
behavioral1
Sample
Pirkimo uzsakymu sarasas.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Pirkimo uzsakymu sarasas.exe
Resource
win10v2004-20241007-en
General
-
Target
Pirkimo uzsakymu sarasas.exe
-
Size
1.0MB
-
MD5
324c7cc0801bb21f708800dbea830906
-
SHA1
7b97a0e78df882a73cef95a2cedd7a87dfa4943b
-
SHA256
79af3bcefb9140bdcb1801880ef6cdfb7d3658a5f8b8d9acc39eef8a8acce9f7
-
SHA512
280a4c707fe2683155bebada2f6f75e4623912cf4458a55b7ad787e1f9be0c392823e256357e9db24d4b861981aab88a2e238b6c6f5621e95a2e42edffcb24ca
-
SSDEEP
24576:/GBqWzMJ3rInJFhR1T6a356ZFlR+gKT44VoIOL7zk:/CHncaUYL6L
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral2/memory/4720-2-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-7-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-9-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-17-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-16-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-15-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-22-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-31-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-42-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-72-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-51-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-71-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-70-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-69-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-68-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-49-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-48-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-47-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-62-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-61-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-60-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-43-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-58-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-57-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-56-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-55-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-40-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-54-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-50-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-37-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-67-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-46-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-45-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-33-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-59-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-44-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-32-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-30-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-41-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-29-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-39-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-28-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-38-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-27-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-36-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-26-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-35-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-34-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-25-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-24-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-23-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-21-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-20-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-19-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-18-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-14-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-13-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-10-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-12-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-11-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 behavioral2/memory/4720-8-0x0000000002B90000-0x0000000003B90000-memory.dmp modiloader_stage2 -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 14 bitbucket.org 16 bitbucket.org -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pirkimo uzsakymu sarasas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SndVol.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 16 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4720 Pirkimo uzsakymu sarasas.exe 4720 Pirkimo uzsakymu sarasas.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3892 SndVol.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3892 SndVol.exe 3892 SndVol.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3892 4720 Pirkimo uzsakymu sarasas.exe 93 PID 4720 wrote to memory of 3892 4720 Pirkimo uzsakymu sarasas.exe 93 PID 4720 wrote to memory of 3892 4720 Pirkimo uzsakymu sarasas.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pirkimo uzsakymu sarasas.exe"C:\Users\Admin\AppData\Local\Temp\Pirkimo uzsakymu sarasas.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3892
-