Analysis
-
max time kernel
126s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 00:52
Static task
static1
Behavioral task
behavioral1
Sample
85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe
Resource
win10v2004-20241007-en
General
-
Target
85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe
-
Size
112KB
-
MD5
774e0a943af622561eed185a81b728dc
-
SHA1
79798d26b0bb3fd5073af59da652cbc1a0206c4e
-
SHA256
85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38
-
SHA512
ccb17a24b06fd9b2ca51be56a37c6062ecd3801e751de307e7354c0ac08d5b3a17c45d6a088ed42fc8a11cfc17acf270034b0c9700e8584cc31fdfd536077952
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral2/memory/3020-64-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3020-63-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3020-71-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe -
Executes dropped EXE 3 IoCs
pid Process 4416 WAMain.exe 2492 WAMain.exe 3020 WAMain.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 828 set thread context of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 set thread context of 2020 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 84 PID 4416 set thread context of 2000 4416 WAMain.exe 90 PID 4416 set thread context of 2492 4416 WAMain.exe 91 PID 4416 set thread context of 3020 4416 WAMain.exe 92 -
resource yara_rule behavioral2/memory/2020-17-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2020-18-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2020-20-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2020-49-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3020-58-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3020-64-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3020-63-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3020-61-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2020-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2492-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3020-71-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe 4392 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe Token: SeDebugPrivilege 2492 WAMain.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 4392 svchost.exe 2020 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 4416 WAMain.exe 2492 WAMain.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 828 wrote to memory of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 wrote to memory of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 wrote to memory of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 wrote to memory of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 wrote to memory of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 wrote to memory of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 wrote to memory of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 wrote to memory of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 wrote to memory of 4392 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 83 PID 828 wrote to memory of 2020 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 84 PID 828 wrote to memory of 2020 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 84 PID 828 wrote to memory of 2020 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 84 PID 828 wrote to memory of 2020 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 84 PID 828 wrote to memory of 2020 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 84 PID 828 wrote to memory of 2020 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 84 PID 828 wrote to memory of 2020 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 84 PID 828 wrote to memory of 2020 828 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 84 PID 2020 wrote to memory of 4572 2020 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 85 PID 2020 wrote to memory of 4572 2020 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 85 PID 2020 wrote to memory of 4572 2020 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 85 PID 4572 wrote to memory of 364 4572 cmd.exe 88 PID 4572 wrote to memory of 364 4572 cmd.exe 88 PID 4572 wrote to memory of 364 4572 cmd.exe 88 PID 2020 wrote to memory of 4416 2020 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 89 PID 2020 wrote to memory of 4416 2020 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 89 PID 2020 wrote to memory of 4416 2020 85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe 89 PID 4416 wrote to memory of 2000 4416 WAMain.exe 90 PID 4416 wrote to memory of 2000 4416 WAMain.exe 90 PID 4416 wrote to memory of 2000 4416 WAMain.exe 90 PID 4416 wrote to memory of 2000 4416 WAMain.exe 90 PID 4416 wrote to memory of 2000 4416 WAMain.exe 90 PID 4416 wrote to memory of 2000 4416 WAMain.exe 90 PID 4416 wrote to memory of 2000 4416 WAMain.exe 90 PID 4416 wrote to memory of 2000 4416 WAMain.exe 90 PID 4416 wrote to memory of 2000 4416 WAMain.exe 90 PID 4416 wrote to memory of 2492 4416 WAMain.exe 91 PID 4416 wrote to memory of 2492 4416 WAMain.exe 91 PID 4416 wrote to memory of 2492 4416 WAMain.exe 91 PID 4416 wrote to memory of 2492 4416 WAMain.exe 91 PID 4416 wrote to memory of 2492 4416 WAMain.exe 91 PID 4416 wrote to memory of 2492 4416 WAMain.exe 91 PID 4416 wrote to memory of 2492 4416 WAMain.exe 91 PID 4416 wrote to memory of 2492 4416 WAMain.exe 91 PID 4416 wrote to memory of 3020 4416 WAMain.exe 92 PID 4416 wrote to memory of 3020 4416 WAMain.exe 92 PID 4416 wrote to memory of 3020 4416 WAMain.exe 92 PID 4416 wrote to memory of 3020 4416 WAMain.exe 92 PID 4416 wrote to memory of 3020 4416 WAMain.exe 92 PID 4416 wrote to memory of 3020 4416 WAMain.exe 92 PID 4416 wrote to memory of 3020 4416 WAMain.exe 92 PID 4416 wrote to memory of 3020 4416 WAMain.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe"C:\Users\Admin\AppData\Local\Temp\85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
C:\Users\Admin\AppData\Local\Temp\85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe"C:\Users\Admin\AppData\Local\Temp\85704608921a9469f59f3e786ce955682b36c279af033140e6da2ea60e5cbc38.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SGJFD.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:364
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:2000
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2492
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD5f06f025f90e46cabd8a1ba3b004389e0
SHA1ca1c137f1671fa392738971c65f2bd7323d00cbe
SHA256fd0b501d4795ecb41bbc6921bc6762f930c3283d7fd5b38d50583501083e9f3c
SHA5120ef1cdf7049b565e6609a45a7f4426ef75ed79f346dc939488a1f4113cbb297921dec2a06cd2b96b66fe6cf4b9b88c5f0e408eb64f587e436e38cda68353a2db