Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
02-12-2024 21:53
General
-
Target
66da76123044dec1e202af86850ee69061f3e75238c2dc723c9f0740e53987a2N.exe
-
Size
90KB
-
MD5
0025b1dfb75226810a4cc31936d06a20
-
SHA1
2a5a64f9c6954dbc82f187c9e2d8cbceb87bf83c
-
SHA256
66da76123044dec1e202af86850ee69061f3e75238c2dc723c9f0740e53987a2
-
SHA512
abf0b9ccff6eb722097289b2478ad1476bf0e76c552d2e85293170ace10f4ed2f9f77ee1c64cf23f03d695ca4cc29d5292a19ffd47cb5ec8f1e8e2468e0ab4ff
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDQ:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3S
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66da76123044dec1e202af86850ee69061f3e75238c2dc723c9f0740e53987a2N.exe"C:\Users\Admin\AppData\Local\Temp\66da76123044dec1e202af86850ee69061f3e75238c2dc723c9f0740e53987a2N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\66da76123044dec1e202af86850ee69061f3e75238c2dc723c9f0740e53987a2N.exe"C:\Users\Admin\AppData\Local\Temp\66da76123044dec1e202af86850ee69061f3e75238c2dc723c9f0740e53987a2N.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BXWAO.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
90KB
MD50b30dfef9ed89fcfe465ffb31cf785d2
SHA1873c769c68604a3874731163723248221dddbcff
SHA256c30ccf240b0bf3be985d896a7c3ad371485229ccf6ea72f77e3087127bd9965c
SHA512c931f044cd9a1a12e329a5cb0c90ffc27de64bf6393dbcca6ce50e0cda1f5fe030755d0dd8331b9d2a79c0707faeab4c9d35ab4896a81c6702e90ccdea08363b
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
44KB
-
Filesize
332KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
332KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
44KB