Analysis
-
max time kernel
297s -
max time network
287s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 15:56
Static task
static1
Behavioral task
behavioral1
Sample
Árajánlat kérés·docx.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Árajánlat kérés·docx.exe
Resource
win10v2004-20241007-en
General
-
Target
Árajánlat kérés·docx.exe
-
Size
1.0MB
-
MD5
a0933f0aba5007aa88ebba82448924f3
-
SHA1
41e13083c19a3a6b6ab5c8d7911b0c9c2db7bec0
-
SHA256
8a12c772b4048f6873c3f1805f72a32748c6a710049c210c845a1b32183b96d4
-
SHA512
3cb16ef9e7d3bcc8d807415e7c00fbe200fa489949956c046f9b88c626466f3a89133aa66487927c439cdde6fb5ec828c5e46440fa5ce06d48dd5c64b68c0b3e
-
SSDEEP
24576:BJSK4Kavab3wMeAOz6ZFlR+gKT44VoIOL7zk:7K1uYL6L
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral1/memory/2928-2-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-41-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-7-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-42-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-35-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-65-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-63-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-62-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-60-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-58-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-56-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-55-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-53-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-52-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-50-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-48-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-47-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-44-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-43-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-40-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-34-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-33-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-31-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-30-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-28-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-27-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-25-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-24-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-9-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-21-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-20-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-8-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-17-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-16-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-59-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-57-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-51-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-14-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-46-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-13-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-39-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-36-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-32-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-11-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-22-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-19-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-75-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-18-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-68-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-64-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-61-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-15-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-54-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-49-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-45-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-37-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-12-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-29-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-26-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-23-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 behavioral1/memory/2928-10-0x0000000003550000-0x0000000004550000-memory.dmp modiloader_stage2 -
Executes dropped EXE 7 IoCs
pid Process 936 alpha.pif 2688 alpha.pif 3044 alpha.pif 1644 xpha.pif 2128 alpha.pif 1400 alpha.pif 1572 alpha.pif -
Loads dropped DLL 4 IoCs
pid Process 2472 cmd.exe 2472 cmd.exe 2472 cmd.exe 3044 alpha.pif -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3040 set thread context of 1200 3040 SndVol.exe 21 PID 2372 set thread context of 1200 2372 explorer.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SndVol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Árajánlat kérés·docx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1396 esentutl.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2928 Árajánlat kérés·docx.exe 3040 SndVol.exe 3040 SndVol.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3040 SndVol.exe 3040 SndVol.exe 3040 SndVol.exe 2372 explorer.exe 2372 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3040 SndVol.exe Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeDebugPrivilege 2372 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3040 SndVol.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3040 SndVol.exe 3040 SndVol.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2472 2928 Árajánlat kérés·docx.exe 29 PID 2928 wrote to memory of 2472 2928 Árajánlat kérés·docx.exe 29 PID 2928 wrote to memory of 2472 2928 Árajánlat kérés·docx.exe 29 PID 2928 wrote to memory of 2472 2928 Árajánlat kérés·docx.exe 29 PID 2472 wrote to memory of 2288 2472 cmd.exe 31 PID 2472 wrote to memory of 2288 2472 cmd.exe 31 PID 2472 wrote to memory of 2288 2472 cmd.exe 31 PID 2472 wrote to memory of 2288 2472 cmd.exe 31 PID 2472 wrote to memory of 1396 2472 cmd.exe 32 PID 2472 wrote to memory of 1396 2472 cmd.exe 32 PID 2472 wrote to memory of 1396 2472 cmd.exe 32 PID 2472 wrote to memory of 1396 2472 cmd.exe 32 PID 2472 wrote to memory of 936 2472 cmd.exe 33 PID 2472 wrote to memory of 936 2472 cmd.exe 33 PID 2472 wrote to memory of 936 2472 cmd.exe 33 PID 2472 wrote to memory of 936 2472 cmd.exe 33 PID 2472 wrote to memory of 2688 2472 cmd.exe 34 PID 2472 wrote to memory of 2688 2472 cmd.exe 34 PID 2472 wrote to memory of 2688 2472 cmd.exe 34 PID 2472 wrote to memory of 2688 2472 cmd.exe 34 PID 2472 wrote to memory of 3044 2472 cmd.exe 35 PID 2472 wrote to memory of 3044 2472 cmd.exe 35 PID 2472 wrote to memory of 3044 2472 cmd.exe 35 PID 2472 wrote to memory of 3044 2472 cmd.exe 35 PID 3044 wrote to memory of 1644 3044 alpha.pif 36 PID 3044 wrote to memory of 1644 3044 alpha.pif 36 PID 3044 wrote to memory of 1644 3044 alpha.pif 36 PID 3044 wrote to memory of 1644 3044 alpha.pif 36 PID 2472 wrote to memory of 2128 2472 cmd.exe 37 PID 2472 wrote to memory of 2128 2472 cmd.exe 37 PID 2472 wrote to memory of 2128 2472 cmd.exe 37 PID 2472 wrote to memory of 2128 2472 cmd.exe 37 PID 2472 wrote to memory of 1400 2472 cmd.exe 38 PID 2472 wrote to memory of 1400 2472 cmd.exe 38 PID 2472 wrote to memory of 1400 2472 cmd.exe 38 PID 2472 wrote to memory of 1400 2472 cmd.exe 38 PID 2472 wrote to memory of 1572 2472 cmd.exe 39 PID 2472 wrote to memory of 1572 2472 cmd.exe 39 PID 2472 wrote to memory of 1572 2472 cmd.exe 39 PID 2472 wrote to memory of 1572 2472 cmd.exe 39 PID 2928 wrote to memory of 3040 2928 Árajánlat kérés·docx.exe 40 PID 2928 wrote to memory of 3040 2928 Árajánlat kérés·docx.exe 40 PID 2928 wrote to memory of 3040 2928 Árajánlat kérés·docx.exe 40 PID 2928 wrote to memory of 3040 2928 Árajánlat kérés·docx.exe 40 PID 2928 wrote to memory of 3040 2928 Árajánlat kérés·docx.exe 40 PID 1200 wrote to memory of 2372 1200 Explorer.EXE 41 PID 1200 wrote to memory of 2372 1200 Explorer.EXE 41 PID 1200 wrote to memory of 2372 1200 Explorer.EXE 41 PID 1200 wrote to memory of 2372 1200 Explorer.EXE 41 PID 2372 wrote to memory of 2360 2372 explorer.exe 42 PID 2372 wrote to memory of 2360 2372 explorer.exe 42 PID 2372 wrote to memory of 2360 2372 explorer.exe 42 PID 2372 wrote to memory of 2360 2372 explorer.exe 42
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\Árajánlat kérés·docx.exe"C:\Users\Admin\AppData\Local\Temp\Árajánlat kérés·docx.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Libraries\rqbnwzgR.cmd" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o4⤵PID:2288
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o4⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1396
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:936
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 104⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644
-
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2128
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW644⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572
-
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3040
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\SndVol.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2360
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5b87f096cbc25570329e2bb59fee57580
SHA1d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA51272901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
-
Filesize
15KB
MD56242e3d67787ccbf4e06ad2982853144
SHA16ac7947207d999a65890ab25fe344955da35028e
SHA2564ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d
SHA5127d0d457e1537d624119a8023bcc086575696a5739c0460ef11554afac13af5e5d1edc7629a10e62834aba9f1b3ab1442011b15b4c3930399d91dca34b3b1cbaf
-
Filesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1