modiloader | 188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/12/2024, 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe
Size

264KB
MD5

dca687f9cad949e2e8ba03c6bfd34fd2
SHA1

5a277ef971a34d844dfc01e0446a6e707bcefe34
SHA256

188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad
SHA512

8af24f196c3a07d0828051b27fbfc7994eedec2dccd7112787e437f1f88d1e81af6fa2f3ec70da8c953433ac89a37a4f0fe4c60084ddf2a3ce5bc3d1e6f0d10c
SSDEEP

6144:d02c94nYY+uUMFemOFu3Ksm2Yn+EE9j+ivEyPYxJQeyE:aSnYPweZnl+EER+iv6IeyE

Score

10^/10

modiloader discovery evasion execution persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2728	mshta.exe	31

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs

evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 59 IoCs

resource	yara_rule
behavioral1/memory/2872-4-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/2872-2-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/2872-5-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/2872-6-0x0000000001D70000-0x0000000001E46000-memory.dmp	modiloader_stage2
behavioral1/memory/2872-9-0x0000000001D70000-0x0000000001E46000-memory.dmp	modiloader_stage2
behavioral1/memory/2872-8-0x0000000001D70000-0x0000000001E46000-memory.dmp	modiloader_stage2
behavioral1/memory/2872-7-0x0000000001D70000-0x0000000001E46000-memory.dmp	modiloader_stage2
behavioral1/memory/2872-11-0x0000000001D70000-0x0000000001E46000-memory.dmp	modiloader_stage2
behavioral1/memory/2872-12-0x0000000001D70000-0x0000000001E46000-memory.dmp	modiloader_stage2
behavioral1/memory/2336-22-0x0000000006220000-0x00000000062F6000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-23-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-24-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-31-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-37-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-47-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-48-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-49-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-46-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-45-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-44-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-43-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-42-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-41-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-40-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-39-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-38-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-36-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-35-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-34-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-32-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-33-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-30-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-29-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-28-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-27-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2336-26-0x0000000006220000-0x00000000062F6000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-54-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-58-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-57-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-56-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-55-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-66-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-60-0x0000000000220000-0x0000000000361000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-67-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-71-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-68-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-79-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-69-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-70-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-73-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-74-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-82-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-81-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-80-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-78-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-77-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-76-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-75-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1308-72-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

pid	Process
2880	regsvr32.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d6fd.lnk	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:lOYS6qt=\"h\";z2V=new%20ActiveXObject(\"WScript.Shell\");C7nf0x=\"pF\";k8DQF=z2V.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\xpeofbyaxp\\\\lshyhcdmls\");DHmRtQ5=\"U\";eval(k8DQF);OY9flC=\"lRihx6r\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:z7QsCQ=\"s6X9A\";a54y=new%20ActiveXObject(\"WScript.Shell\");PtymR3f2s=\"4SDN70XT\";tmAb1=a54y.RegRead(\"HKCU\\\\software\\\\xpeofbyaxp\\\\lshyhcdmls\");aX9dRSm1=\"lKK4W5O\";eval(tmAb1);ghcFz2=\"j\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\c1e1\\cc22.lnk\""	regsvr32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2336	powershell.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2748 set thread context of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2336 set thread context of 2880	2336	powershell.exe	36
PID 2880 set thread context of 1308	2880	regsvr32.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\6042\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\6042\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\6042\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\6042\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:edbPlG6x=\"L\";xt1=new ActiveXObject(\"WScript.Shell\");EKd2Fv1=\"4K9sS\";q8AF6S=xt1.RegRead(\"HKCU\\\\software\\\\xpeofbyaxp\\\\lshyhcdmls\");ntA3N=\"d\";eval(q8AF6S);sCCr5Ir=\"LsMifIm\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.96c88	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.96c88\ = "6042"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\6042	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2336	powershell.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe
2880	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2336	powershell.exe
2880	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2748 wrote to memory of 2872	2748	188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe	30
PID 2648 wrote to memory of 2336	2648	mshta.exe	33
PID 2648 wrote to memory of 2336	2648	mshta.exe	33
PID 2648 wrote to memory of 2336	2648	mshta.exe	33
PID 2648 wrote to memory of 2336	2648	mshta.exe	33
PID 2336 wrote to memory of 2880	2336	powershell.exe	36
PID 2336 wrote to memory of 2880	2336	powershell.exe	36
PID 2336 wrote to memory of 2880	2336	powershell.exe	36
PID 2336 wrote to memory of 2880	2336	powershell.exe	36
PID 2336 wrote to memory of 2880	2336	powershell.exe	36
PID 2336 wrote to memory of 2880	2336	powershell.exe	36
PID 2336 wrote to memory of 2880	2336	powershell.exe	36
PID 2336 wrote to memory of 2880	2336	powershell.exe	36
PID 2880 wrote to memory of 1308	2880	regsvr32.exe	37
PID 2880 wrote to memory of 1308	2880	regsvr32.exe	37
PID 2880 wrote to memory of 1308	2880	regsvr32.exe	37
PID 2880 wrote to memory of 1308	2880	regsvr32.exe	37
PID 2880 wrote to memory of 1308	2880	regsvr32.exe	37
PID 2880 wrote to memory of 1308	2880	regsvr32.exe	37
PID 2880 wrote to memory of 1308	2880	regsvr32.exe	37
PID 2880 wrote to memory of 1308	2880	regsvr32.exe	37

C:\Users\Admin\AppData\Local\Temp\188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe
"C:\Users\Admin\AppData\Local\Temp\188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe
  "C:\Users\Admin\AppData\Local\Temp\188e6b2e03d97b9a53fee12d9b92b452865e47ab1816fec097647026d420dbad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2872

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:I2jSNRz="o";F51r=new%20ActiveXObject("WScript.Shell");der05x="nwd2ALh";S2ytB=F51r.RegRead("HKLM\\software\\Wow6432Node\\Ydv9bOU1yb\\xbSnJA3");WgF3y="Fpi7V9Dn";eval(S2ytB);fSZb5BI9="xpguq6";
1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ztkip
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Deletes itself
    - Drops startup file
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\SysWOW64\regsvr32.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\c1e1\cc22.lnk

Filesize
857B

MD5
2b60274f10e84c1611a1cabdba3b5095

SHA1
9cf7d968d8685ac3b69cceafe18c36d7ee8f85ef

SHA256
ceff2abcdb7913a59ad6d7055384a77e549a79b8b6d189076e4381d24ad53f72

SHA512
cbbc85e639a0c73423249fbe7b85a2e33dca557d58bf01614af52c80aa213e6fe2295ffa0a3503c666ada366ee07369736db795a1b1be1a97c2e3abc8a1701bb

Download Submit
C:\Users\Admin\AppData\Local\c1e1\d3e1.96c88

Filesize
23KB

MD5
37a9a01b6111d8de3591261ddc9985af

SHA1
df39775b68e4d9e3f58fac948dd686270bd6ec84

SHA256
b20ea690cadb76156c82b3e8954c0f79bc15020c694a9541c498d518752d6200

SHA512
41e34d4682b06ac2bd3e4fb8645b9912e7856a5b4a31fb51ff4d5340dfd02095705f3c8b77f84afb066f2eb223e20e09ef40a68702d1b51ce7579c44e59c8132

Download Submit
C:\Users\Admin\AppData\Local\c1e1\d404.bat

Filesize
55B

MD5
7fa8eaf7cd5fb0188bd71ed27b9f2dde

SHA1
17a29ca08dfe012861e4ec4c78b67c4a68eac400

SHA256
2a71166bdde641b5b899d4703d987b3d5770f84cd3ffcbc49a1e9a83dbfeb0c0

SHA512
812dcb01ccc6d2b80d63313b6bf24c89939e6227289eb73ac788facc09ff539c29c262f8505727f958a46e3d8e5f59864afe57774d2a64076f5f7b73823b5c39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d6fd.lnk

Filesize
975B

MD5
5821332aacf21aafbd79d2302dd2c279

SHA1
818750ca40b3163f5d69470a010c7a3625fa1bac

SHA256
40cb7c59d843fd246c36e447e84194a00beec75b9b31999c1274a54f534bd059

SHA512
d4450c360e022d1e09664a667256bc3d80cbe399b8f73a78efffbc64e7b2f9ca4753b543321a071bd4711522c6c7167e4ba11b1cde0b770e2e1f19b3839f02fc

Download Submit
C:\Users\Admin\AppData\Roaming\d4b9\21c5.96c88

Filesize
41KB

MD5
f1c2a1282fd45a909521425d6564c5c6

SHA1
4c3b3b905f9a90cde90c32fd874040edf0acb207

SHA256
5ee822a2ab97deddb99d65ac06f921eff8ca205541e8c8d0a84deda8bd2de869

SHA512
d6a3a3bc1e4774d87cad8ef082f8ae2758536a8fdbfdbf78302ecc85d1e35865e9ea23466978037aed0b39021d013e8fa34cb2971f4510e7c7bdcfc8b8a100bd

Download Submit
memory/1308-69-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-67-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-73-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-81-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-80-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-82-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-79-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-68-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-71-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-70-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-72-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-74-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-75-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-76-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-77-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1308-78-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/2336-22-0x0000000006220000-0x00000000062F6000-memory.dmp

Filesize
856KB

Download
memory/2336-26-0x0000000006220000-0x00000000062F6000-memory.dmp

Filesize
856KB

Download
memory/2872-12-0x0000000001D70000-0x0000000001E46000-memory.dmp

Filesize
856KB

Download
memory/2872-4-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2872-11-0x0000000001D70000-0x0000000001E46000-memory.dmp

Filesize
856KB

Download
memory/2872-7-0x0000000001D70000-0x0000000001E46000-memory.dmp

Filesize
856KB

Download
memory/2872-8-0x0000000001D70000-0x0000000001E46000-memory.dmp

Filesize
856KB

Download
memory/2872-9-0x0000000001D70000-0x0000000001E46000-memory.dmp

Filesize
856KB

Download
memory/2872-6-0x0000000001D70000-0x0000000001E46000-memory.dmp

Filesize
856KB

Download
memory/2872-5-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2872-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2880-49-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-28-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-27-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-29-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-54-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-58-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-57-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-56-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-55-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-66-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-60-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-30-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-33-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-32-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-34-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-35-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-36-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-38-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-39-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-40-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-41-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-42-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-43-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-44-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-45-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-46-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-48-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-47-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-37-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-31-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-24-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download
memory/2880-23-0x0000000000220000-0x0000000000361000-memory.dmp

Filesize
1.3MB

Download