Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 00:38
Behavioral task
behavioral1
Sample
3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe
Resource
win10v2004-20241007-en
General
-
Target
3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe
-
Size
94KB
-
MD5
fb0dd103eb3d2de5f8dfea694b13938b
-
SHA1
fbd8954f0f05ee2dcae5751c413fe5ed0924ed07
-
SHA256
3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4
-
SHA512
90605d6ed49b0fa22ae8d5b186eb4bcdf5257b1d85ff0b93c4c6b744fb849810dfc59506f4e845036d64c7d68c467c07d01e84998da221cd83bd066765ade8c3
-
SSDEEP
1536:/pdyL9GjGiwA1z0PmVggNJKbFD2BBMx1RiwmPJr3raDk5BRf13KH9m2POE/d:/pdyLALwACPmV3NYaYLiwIt3raA5BRfe
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/12276-147854-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
pid Process 13192 csrsll.exe 12212 csrsll.exe 12276 csrsll.exe -
Loads dropped DLL 5 IoCs
pid Process 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2868 set thread context of 22448 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 28 PID 13192 set thread context of 12212 13192 csrsll.exe 34 PID 13192 set thread context of 12276 13192 csrsll.exe 35 -
resource yara_rule behavioral1/memory/2868-0-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2868-162-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2868-52311-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2868-73918-0x00000000027F0000-0x0000000002846000-memory.dmp upx behavioral1/memory/22448-73921-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/22448-73926-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/22448-73923-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/22448-73927-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2868-73930-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/22448-73929-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000800000001211a-73967.dat upx behavioral1/memory/22448-147849-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/12276-147846-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/12212-147845-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/13192-147841-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/12276-147854-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/12212-147853-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe Token: SeDebugPrivilege 12212 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 13192 csrsll.exe 12212 csrsll.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2868 wrote to memory of 22448 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 28 PID 2868 wrote to memory of 22448 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 28 PID 2868 wrote to memory of 22448 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 28 PID 2868 wrote to memory of 22448 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 28 PID 2868 wrote to memory of 22448 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 28 PID 2868 wrote to memory of 22448 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 28 PID 2868 wrote to memory of 22448 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 28 PID 2868 wrote to memory of 22448 2868 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 28 PID 22448 wrote to memory of 13136 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 29 PID 22448 wrote to memory of 13136 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 29 PID 22448 wrote to memory of 13136 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 29 PID 22448 wrote to memory of 13136 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 29 PID 13136 wrote to memory of 13232 13136 cmd.exe 31 PID 13136 wrote to memory of 13232 13136 cmd.exe 31 PID 13136 wrote to memory of 13232 13136 cmd.exe 31 PID 13136 wrote to memory of 13232 13136 cmd.exe 31 PID 22448 wrote to memory of 13192 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 32 PID 22448 wrote to memory of 13192 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 32 PID 22448 wrote to memory of 13192 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 32 PID 22448 wrote to memory of 13192 22448 3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe 32 PID 13192 wrote to memory of 12212 13192 csrsll.exe 34 PID 13192 wrote to memory of 12212 13192 csrsll.exe 34 PID 13192 wrote to memory of 12212 13192 csrsll.exe 34 PID 13192 wrote to memory of 12212 13192 csrsll.exe 34 PID 13192 wrote to memory of 12212 13192 csrsll.exe 34 PID 13192 wrote to memory of 12212 13192 csrsll.exe 34 PID 13192 wrote to memory of 12212 13192 csrsll.exe 34 PID 13192 wrote to memory of 12212 13192 csrsll.exe 34 PID 13192 wrote to memory of 12276 13192 csrsll.exe 35 PID 13192 wrote to memory of 12276 13192 csrsll.exe 35 PID 13192 wrote to memory of 12276 13192 csrsll.exe 35 PID 13192 wrote to memory of 12276 13192 csrsll.exe 35 PID 13192 wrote to memory of 12276 13192 csrsll.exe 35 PID 13192 wrote to memory of 12276 13192 csrsll.exe 35 PID 13192 wrote to memory of 12276 13192 csrsll.exe 35 PID 13192 wrote to memory of 12276 13192 csrsll.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe"C:\Users\Admin\AppData\Local\Temp\3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe"C:\Users\Admin\AppData\Local\Temp\3a2185fff1ea40d2eb980e084a42872a47668cdf18fd50d94a9e46a3bbce72b4.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:22448 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\YAXLM.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:13136 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:13232
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:13192 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:12212
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:12276
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
94KB
MD5ce9b7fc161e6695786140ef6478dfe8c
SHA1958f48eb2cd0e2c98171c3e22ee9fe89542c60f3
SHA2568b9df168a7db238b3aa08257b9e03cbd472ccd8c2ffb618800fd74bc6c25377c
SHA51255dbd625c58bdd1e6d16df772d8a610cdca3e94eb098ccba5948dc0a5834463a89df15f8d2c03da6a7d552b323b534ec5d3fcd88f1eed7d4ec984a9c4dd6a810