Analysis
-
max time kernel
56s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 06:52
Static task
static1
Behavioral task
behavioral1
Sample
USD470900_COPY_800BLHSBC882001.PDF.bat
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
USD470900_COPY_800BLHSBC882001.PDF.bat
Resource
win10v2004-20241007-en
General
-
Target
USD470900_COPY_800BLHSBC882001.PDF.bat
-
Size
3.2MB
-
MD5
c96743116088d21b52516f16f4866f69
-
SHA1
9b9d500993f74ed975945419b6a25c03e80d8400
-
SHA256
58348cc94b984ca026fa0a319b93ac988a394ed3d5ec39c01c47a8e762ebdb16
-
SHA512
1a7520b8de10e9fb71f18f22287e298f25743a26ea946e71fb3b895bb8679f86986fe2b0ec30a0d7589cd85af404eca27d8ccf2a47f895f9c166c55660a8edd0
-
SSDEEP
24576:PdLbg3tuCmhfOs2TLie3m0nKaf5ohA87eR4xGVPTXJF7wb2l+qCWuj8lzoQjJpcp:PR03turhfwL8uJFlEoNZHk
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral1/memory/1528-33-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-39-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-59-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-60-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-50-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-82-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-81-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-78-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-75-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-73-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-70-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-68-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-67-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-62-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-43-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-115-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-42-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-55-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-54-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-109-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-104-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-102-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-98-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-52-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-93-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-90-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-86-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-83-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-49-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-79-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-48-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-76-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-74-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-72-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-71-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-46-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-45-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-65-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-63-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-58-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-116-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-113-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-110-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-105-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-101-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-53-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-97-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-95-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-91-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-87-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-41-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-84-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-80-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-77-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-40-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-47-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-69-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-66-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-44-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-38-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/1528-37-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 -
Executes dropped EXE 12 IoCs
pid Process 2608 alpha.exe 1624 alpha.exe 2204 kn.exe 2936 alpha.exe 2980 kn.exe 1528 AnyDesk.PIF 332 alpha.exe 2776 alpha.exe 1328 alpha.pif 1820 alpha.pif 1408 alpha.pif 848 xpha.pif -
Loads dropped DLL 7 IoCs
pid Process 2336 cmd.exe 2336 cmd.exe 1624 alpha.exe 2336 cmd.exe 2936 alpha.exe 2420 cmd.exe 1408 alpha.pif -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Faogvkgh = "C:\\Users\\Public\\Faogvkgh.url" AnyDesk.PIF -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AnyDesk.PIF Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SndVol.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2152 esentutl.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1528 AnyDesk.PIF -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2572 2336 cmd.exe 30 PID 2336 wrote to memory of 2572 2336 cmd.exe 30 PID 2336 wrote to memory of 2572 2336 cmd.exe 30 PID 2336 wrote to memory of 2608 2336 cmd.exe 31 PID 2336 wrote to memory of 2608 2336 cmd.exe 31 PID 2336 wrote to memory of 2608 2336 cmd.exe 31 PID 2608 wrote to memory of 1736 2608 alpha.exe 32 PID 2608 wrote to memory of 1736 2608 alpha.exe 32 PID 2608 wrote to memory of 1736 2608 alpha.exe 32 PID 2336 wrote to memory of 1624 2336 cmd.exe 33 PID 2336 wrote to memory of 1624 2336 cmd.exe 33 PID 2336 wrote to memory of 1624 2336 cmd.exe 33 PID 1624 wrote to memory of 2204 1624 alpha.exe 34 PID 1624 wrote to memory of 2204 1624 alpha.exe 34 PID 1624 wrote to memory of 2204 1624 alpha.exe 34 PID 2336 wrote to memory of 2936 2336 cmd.exe 35 PID 2336 wrote to memory of 2936 2336 cmd.exe 35 PID 2336 wrote to memory of 2936 2336 cmd.exe 35 PID 2936 wrote to memory of 2980 2936 alpha.exe 36 PID 2936 wrote to memory of 2980 2936 alpha.exe 36 PID 2936 wrote to memory of 2980 2936 alpha.exe 36 PID 2336 wrote to memory of 1528 2336 cmd.exe 37 PID 2336 wrote to memory of 1528 2336 cmd.exe 37 PID 2336 wrote to memory of 1528 2336 cmd.exe 37 PID 2336 wrote to memory of 1528 2336 cmd.exe 37 PID 2336 wrote to memory of 332 2336 cmd.exe 38 PID 2336 wrote to memory of 332 2336 cmd.exe 38 PID 2336 wrote to memory of 332 2336 cmd.exe 38 PID 2336 wrote to memory of 2776 2336 cmd.exe 39 PID 2336 wrote to memory of 2776 2336 cmd.exe 39 PID 2336 wrote to memory of 2776 2336 cmd.exe 39 PID 1528 wrote to memory of 2420 1528 AnyDesk.PIF 40 PID 1528 wrote to memory of 2420 1528 AnyDesk.PIF 40 PID 1528 wrote to memory of 2420 1528 AnyDesk.PIF 40 PID 1528 wrote to memory of 2420 1528 AnyDesk.PIF 40 PID 2420 wrote to memory of 2196 2420 cmd.exe 42 PID 2420 wrote to memory of 2196 2420 cmd.exe 42 PID 2420 wrote to memory of 2196 2420 cmd.exe 42 PID 2420 wrote to memory of 2196 2420 cmd.exe 42 PID 2420 wrote to memory of 2152 2420 cmd.exe 43 PID 2420 wrote to memory of 2152 2420 cmd.exe 43 PID 2420 wrote to memory of 2152 2420 cmd.exe 43 PID 2420 wrote to memory of 2152 2420 cmd.exe 43 PID 2420 wrote to memory of 1328 2420 cmd.exe 44 PID 2420 wrote to memory of 1328 2420 cmd.exe 44 PID 2420 wrote to memory of 1328 2420 cmd.exe 44 PID 2420 wrote to memory of 1328 2420 cmd.exe 44 PID 2420 wrote to memory of 1820 2420 cmd.exe 45 PID 2420 wrote to memory of 1820 2420 cmd.exe 45 PID 2420 wrote to memory of 1820 2420 cmd.exe 45 PID 2420 wrote to memory of 1820 2420 cmd.exe 45 PID 2420 wrote to memory of 1408 2420 cmd.exe 46 PID 2420 wrote to memory of 1408 2420 cmd.exe 46 PID 2420 wrote to memory of 1408 2420 cmd.exe 46 PID 2420 wrote to memory of 1408 2420 cmd.exe 46 PID 1408 wrote to memory of 848 1408 alpha.pif 47 PID 1408 wrote to memory of 848 1408 alpha.pif 47 PID 1408 wrote to memory of 848 1408 alpha.pif 47 PID 1408 wrote to memory of 848 1408 alpha.pif 47 PID 1528 wrote to memory of 840 1528 AnyDesk.PIF 48 PID 1528 wrote to memory of 840 1528 AnyDesk.PIF 48 PID 1528 wrote to memory of 840 1528 AnyDesk.PIF 48 PID 1528 wrote to memory of 840 1528 AnyDesk.PIF 48 PID 1528 wrote to memory of 2008 1528 AnyDesk.PIF 49
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\USD470900_COPY_800BLHSBC882001.PDF.bat"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵PID:2572
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵PID:1736
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 92⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 93⤵
- Executes dropped EXE
PID:2204
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 123⤵
- Executes dropped EXE
PID:2980
-
-
-
C:\Users\Public\Libraries\AnyDesk.PIFC:\Users\Public\Libraries\AnyDesk.PIF2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Libraries\hgkvgoaF.cmd" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o4⤵PID:2196
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o4⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2152
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1328
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1820
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 104⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:848
-
-
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl.exe /y C:\Users\Public\Libraries\AnyDesk.PIF /d C:\\Users\\Public\\Libraries\\Faogvkgh.PIF /o3⤵PID:840
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- System Location Discovery: System Language Discovery
PID:2008
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:332
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S2⤵
- Executes dropped EXE
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5f4d3d158e042b2f2f6241c94da2370fb
SHA10228ece140a699a52e806ad7a977ed2a1198035e
SHA25628cd0f0300eb2afa9b4ab00193f0d5868ca091e361e4853cc48ec225b1a87e17
SHA512a97fffa538df6c53b2e3c7f594bb46fbdfbc213eacf86bded4d4080fac0ca4eea7ec1ccc6ddbe6037f65f8f1138ad296e1112e48a3074f29564af7e447ddfe9e
-
Filesize
1.2MB
MD5df6f291f617d9dbae8f32fb11ecd59c1
SHA13d26f65c19079bea772572e3367b4185aa4c99ca
SHA25643223d630e7d3898d254eaf0c02264261ada01c3ed93fc119c6550e66f406a5b
SHA5124065e8c1072b89b6d741f8268de54ddb5521acad91fb13491fc1e1ed75467e753764501e201336c67cd7871b0774b835222c53e9f29ddf4ca72dac0d37f5f163
-
Filesize
60KB
MD5b87f096cbc25570329e2bb59fee57580
SHA1d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA51272901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
-
Filesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1
-
Filesize
15KB
MD56242e3d67787ccbf4e06ad2982853144
SHA16ac7947207d999a65890ab25fe344955da35028e
SHA2564ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d
SHA5127d0d457e1537d624119a8023bcc086575696a5739c0460ef11554afac13af5e5d1edc7629a10e62834aba9f1b3ab1442011b15b4c3930399d91dca34b3b1cbaf
-
Filesize
337KB
MD55746bd7e255dd6a8afa06f7c42c1ba41
SHA10f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA5123a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
-
Filesize
1.1MB
MD5ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA2561e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA5124e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2