Analysis
-
max time kernel
14s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 00:46
Static task
static1
Behavioral task
behavioral1
Sample
85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe
Resource
win10v2004-20241007-en
General
-
Target
85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe
-
Size
112KB
-
MD5
774e0a943af622561eed185a81b728dc
-
SHA1
79798d26b0bb3fd5073af59da652cbc1a0206c4e
-
SHA256
85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38
-
SHA512
ccb17a24b06fd9b2ca51be56a37c6062ecd3801e751de307e7354c0ac08d5b3a17c45d6a088ed42fc8a11cfc17acf270034b0c9700e8584cc31fdfd536077952
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/1564-291-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
pid Process 264 WAMain.exe 2516 WAMain.exe 1564 WAMain.exe -
Loads dropped DLL 5 IoCs
pid Process 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2796 set thread context of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 set thread context of 2388 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 32 PID 264 set thread context of 1720 264 WAMain.exe 37 PID 264 set thread context of 2516 264 WAMain.exe 38 PID 264 set thread context of 1564 264 WAMain.exe 39 -
resource yara_rule behavioral1/memory/2388-129-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2388-120-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2388-117-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2388-113-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2388-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2388-288-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1564-281-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2516-279-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1564-291-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2516-290-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe 2776 svchost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2516 WAMain.exe Token: SeDebugPrivilege 2516 WAMain.exe Token: SeDebugPrivilege 2516 WAMain.exe Token: SeDebugPrivilege 2516 WAMain.exe Token: SeDebugPrivilege 2516 WAMain.exe Token: SeDebugPrivilege 2516 WAMain.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 2776 svchost.exe 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 264 WAMain.exe 1720 svchost.exe 2516 WAMain.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2776 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 31 PID 2796 wrote to memory of 2388 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 32 PID 2796 wrote to memory of 2388 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 32 PID 2796 wrote to memory of 2388 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 32 PID 2796 wrote to memory of 2388 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 32 PID 2796 wrote to memory of 2388 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 32 PID 2796 wrote to memory of 2388 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 32 PID 2796 wrote to memory of 2388 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 32 PID 2796 wrote to memory of 2388 2796 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 32 PID 2388 wrote to memory of 2616 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 33 PID 2388 wrote to memory of 2616 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 33 PID 2388 wrote to memory of 2616 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 33 PID 2388 wrote to memory of 2616 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 33 PID 2616 wrote to memory of 1496 2616 cmd.exe 35 PID 2616 wrote to memory of 1496 2616 cmd.exe 35 PID 2616 wrote to memory of 1496 2616 cmd.exe 35 PID 2616 wrote to memory of 1496 2616 cmd.exe 35 PID 2388 wrote to memory of 264 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 36 PID 2388 wrote to memory of 264 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 36 PID 2388 wrote to memory of 264 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 36 PID 2388 wrote to memory of 264 2388 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 36 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 1720 264 WAMain.exe 37 PID 264 wrote to memory of 2516 264 WAMain.exe 38 PID 264 wrote to memory of 2516 264 WAMain.exe 38 PID 264 wrote to memory of 2516 264 WAMain.exe 38 PID 264 wrote to memory of 2516 264 WAMain.exe 38 PID 264 wrote to memory of 2516 264 WAMain.exe 38 PID 264 wrote to memory of 2516 264 WAMain.exe 38 PID 264 wrote to memory of 2516 264 WAMain.exe 38 PID 264 wrote to memory of 2516 264 WAMain.exe 38 PID 264 wrote to memory of 1564 264 WAMain.exe 39 PID 264 wrote to memory of 1564 264 WAMain.exe 39 PID 264 wrote to memory of 1564 264 WAMain.exe 39 PID 264 wrote to memory of 1564 264 WAMain.exe 39 PID 264 wrote to memory of 1564 264 WAMain.exe 39 PID 264 wrote to memory of 1564 264 WAMain.exe 39 PID 264 wrote to memory of 1564 264 WAMain.exe 39 PID 264 wrote to memory of 1564 264 WAMain.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe"C:\Users\Admin\AppData\Local\Temp\85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe"C:\Users\Admin\AppData\Local\Temp\85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EJYXF.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1496
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2516
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD5354b14b2dd500dfb6f74977846ffcbc1
SHA1f2d26420f773b5bb6349fb33485c7fb4228873ed
SHA256ef8ed96c062e6d40ce97e6ddb42f600de27fcde39fa6694cd3391252a1fca2cc
SHA512032020f54f9856b4162383b0abb93cb7b3364802721df900537ec97258f83f970e9a36defb97ac568bdebfb90df318d4a65b4b1cc7e782c19a083d98f41e46c9