Analysis
-
max time kernel
96s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 15:56
Static task
static1
Behavioral task
behavioral1
Sample
Árajánlat kérés·docx.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Árajánlat kérés·docx.exe
Resource
win10v2004-20241007-en
General
-
Target
Árajánlat kérés·docx.exe
-
Size
1.0MB
-
MD5
a0933f0aba5007aa88ebba82448924f3
-
SHA1
41e13083c19a3a6b6ab5c8d7911b0c9c2db7bec0
-
SHA256
8a12c772b4048f6873c3f1805f72a32748c6a710049c210c845a1b32183b96d4
-
SHA512
3cb16ef9e7d3bcc8d807415e7c00fbe200fa489949956c046f9b88c626466f3a89133aa66487927c439cdde6fb5ec828c5e46440fa5ce06d48dd5c64b68c0b3e
-
SSDEEP
24576:BJSK4Kavab3wMeAOz6ZFlR+gKT44VoIOL7zk:7K1uYL6L
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral2/memory/2912-3-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-7-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-11-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-15-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-14-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-17-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-25-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-38-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-56-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-54-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-63-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-59-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-55-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-51-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-50-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-76-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-73-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-47-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-46-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-45-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-66-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-42-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-62-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-60-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-61-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-41-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-58-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-57-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-37-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-53-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-52-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-35-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-33-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-48-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-32-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-31-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-30-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-43-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-27-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-34-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-49-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-24-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-23-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-44-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-29-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-21-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-28-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-20-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-40-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-26-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-39-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-36-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-19-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-18-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-22-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-16-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-13-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-12-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-8-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-10-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 behavioral2/memory/2912-9-0x0000000002C00000-0x0000000003C00000-memory.dmp modiloader_stage2 -
Executes dropped EXE 4 IoCs
pid Process 5012 alpha.pif 4984 alpha.pif 2776 alpha.pif 1040 xpha.pif -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Árajánlat kérés·docx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1300 esentutl.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 17 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2912 Árajánlat kérés·docx.exe 2912 Árajánlat kérés·docx.exe 4384 colorcpl.exe 4384 colorcpl.exe 4384 colorcpl.exe 4384 colorcpl.exe 4384 colorcpl.exe 4384 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4384 colorcpl.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2912 wrote to memory of 3340 2912 Árajánlat kérés·docx.exe 99 PID 2912 wrote to memory of 3340 2912 Árajánlat kérés·docx.exe 99 PID 2912 wrote to memory of 3340 2912 Árajánlat kérés·docx.exe 99 PID 3340 wrote to memory of 2648 3340 cmd.exe 102 PID 3340 wrote to memory of 2648 3340 cmd.exe 102 PID 3340 wrote to memory of 2648 3340 cmd.exe 102 PID 3340 wrote to memory of 1300 3340 cmd.exe 103 PID 3340 wrote to memory of 1300 3340 cmd.exe 103 PID 3340 wrote to memory of 1300 3340 cmd.exe 103 PID 3340 wrote to memory of 5012 3340 cmd.exe 104 PID 3340 wrote to memory of 5012 3340 cmd.exe 104 PID 3340 wrote to memory of 5012 3340 cmd.exe 104 PID 3340 wrote to memory of 4984 3340 cmd.exe 105 PID 3340 wrote to memory of 4984 3340 cmd.exe 105 PID 3340 wrote to memory of 4984 3340 cmd.exe 105 PID 3340 wrote to memory of 2776 3340 cmd.exe 106 PID 3340 wrote to memory of 2776 3340 cmd.exe 106 PID 3340 wrote to memory of 2776 3340 cmd.exe 106 PID 2776 wrote to memory of 1040 2776 alpha.pif 107 PID 2776 wrote to memory of 1040 2776 alpha.pif 107 PID 2776 wrote to memory of 1040 2776 alpha.pif 107 PID 2912 wrote to memory of 4384 2912 Árajánlat kérés·docx.exe 108 PID 2912 wrote to memory of 4384 2912 Árajánlat kérés·docx.exe 108 PID 2912 wrote to memory of 4384 2912 Árajánlat kérés·docx.exe 108 PID 2912 wrote to memory of 4384 2912 Árajánlat kérés·docx.exe 108 PID 4384 wrote to memory of 4672 4384 colorcpl.exe 110 PID 4384 wrote to memory of 4672 4384 colorcpl.exe 110 PID 4384 wrote to memory of 4672 4384 colorcpl.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\Árajánlat kérés·docx.exe"C:\Users\Admin\AppData\Local\Temp\Árajánlat kérés·docx.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\rqbnwzgR.cmd" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o3⤵PID:2648
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1300
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5012
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4984
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 104⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040
-
-
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"3⤵PID:4672
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5b87f096cbc25570329e2bb59fee57580
SHA1d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA51272901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
-
Filesize
18KB
MD5b3624dd758ccecf93a1226cef252ca12
SHA1fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA2564aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838