modiloader | e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
Size

152KB
MD5

e50acbee0e5c9c466b933f238b0d24a0
SHA1

3d8844e3e9f78ec7bf9e052323e946bcf9508e7a
SHA256

e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650
SHA512

0f1a8b16e0154608c51d1a25dcae5864419e737069b1d76ab0e46c5c32ce25626a8467754d35b14ec71cc853bfd0adc36b0876e48ade559008bfba6058f791fb
SSDEEP

1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

Score

10^/10

modiloader discovery persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/1688-773-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral1/memory/2780-1495-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral1/memory/1764-2190-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral1/memory/1764-2201-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

Executes dropped EXE 13 IoCs

pid	Process
1372	svhust.exe
2320	svhust.exe
1688	svhust.exe
548	AdobeART.exe
592	AdobeART.exe
1860	svhust.exe
2252	svhust.exe
2780	svhust.exe
2904	AdobeART.exe
2944	AdobeART.exe
264	svhust.exe
480	svhust.exe
1764	svhust.exe

Loads dropped DLL 16 IoCs

pid	Process
2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
1372	svhust.exe
1372	svhust.exe
1688	svhust.exe
1688	svhust.exe
548	AdobeART.exe
592	AdobeART.exe
592	AdobeART.exe
592	AdobeART.exe
2780	svhust.exe
2944	AdobeART.exe
2944	AdobeART.exe
2944	AdobeART.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe"	svhust.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 2660 set thread context of 2516	2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	30
PID 1372 set thread context of 2320	1372	svhust.exe	35
PID 1372 set thread context of 1688	1372	svhust.exe	36
PID 548 set thread context of 592	548	AdobeART.exe	38
PID 1860 set thread context of 2252	1860	svhust.exe	40
PID 1860 set thread context of 2780	1860	svhust.exe	41
PID 2904 set thread context of 2944	2904	AdobeART.exe	43
PID 264 set thread context of 480	264	svhust.exe	45
PID 264 set thread context of 1764	264	svhust.exe	46

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2516-361-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2516-776-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1688-773-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2780-1479-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/592-1484-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2780-1495-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2944-1810-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1764-2190-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2944-2195-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2320-2196-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2252-2197-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/480-2200-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1764-2201-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeART.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeART.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeART.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeART.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe
Token: SeDebugPrivilege	2252	svhust.exe
Token: SeDebugPrivilege	480	svhust.exe
Token: SeDebugPrivilege	2320	svhust.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
1372	svhust.exe
2320	svhust.exe
548	AdobeART.exe
592	AdobeART.exe
1860	svhust.exe
2252	svhust.exe
2904	AdobeART.exe
2944	AdobeART.exe
264	svhust.exe
480	svhust.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2516	2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	30
PID 2660 wrote to memory of 2516	2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	30
PID 2660 wrote to memory of 2516	2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	30
PID 2660 wrote to memory of 2516	2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	30
PID 2660 wrote to memory of 2516	2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	30
PID 2660 wrote to memory of 2516	2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	30
PID 2660 wrote to memory of 2516	2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	30
PID 2660 wrote to memory of 2516	2660	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	30
PID 2516 wrote to memory of 2708	2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	31
PID 2516 wrote to memory of 2708	2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	31
PID 2516 wrote to memory of 2708	2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	31
PID 2516 wrote to memory of 2708	2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	31
PID 2708 wrote to memory of 852	2708	cmd.exe	33
PID 2708 wrote to memory of 852	2708	cmd.exe	33
PID 2708 wrote to memory of 852	2708	cmd.exe	33
PID 2708 wrote to memory of 852	2708	cmd.exe	33
PID 2516 wrote to memory of 1372	2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	34
PID 2516 wrote to memory of 1372	2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	34
PID 2516 wrote to memory of 1372	2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	34
PID 2516 wrote to memory of 1372	2516	e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe	34
PID 1372 wrote to memory of 2320	1372	svhust.exe	35
PID 1372 wrote to memory of 2320	1372	svhust.exe	35
PID 1372 wrote to memory of 2320	1372	svhust.exe	35
PID 1372 wrote to memory of 2320	1372	svhust.exe	35
PID 1372 wrote to memory of 2320	1372	svhust.exe	35
PID 1372 wrote to memory of 2320	1372	svhust.exe	35
PID 1372 wrote to memory of 2320	1372	svhust.exe	35
PID 1372 wrote to memory of 2320	1372	svhust.exe	35
PID 1372 wrote to memory of 1688	1372	svhust.exe	36
PID 1372 wrote to memory of 1688	1372	svhust.exe	36
PID 1372 wrote to memory of 1688	1372	svhust.exe	36
PID 1372 wrote to memory of 1688	1372	svhust.exe	36
PID 1372 wrote to memory of 1688	1372	svhust.exe	36
PID 1372 wrote to memory of 1688	1372	svhust.exe	36
PID 1372 wrote to memory of 1688	1372	svhust.exe	36
PID 1372 wrote to memory of 1688	1372	svhust.exe	36
PID 1688 wrote to memory of 548	1688	svhust.exe	37
PID 1688 wrote to memory of 548	1688	svhust.exe	37
PID 1688 wrote to memory of 548	1688	svhust.exe	37
PID 1688 wrote to memory of 548	1688	svhust.exe	37
PID 548 wrote to memory of 592	548	AdobeART.exe	38
PID 548 wrote to memory of 592	548	AdobeART.exe	38
PID 548 wrote to memory of 592	548	AdobeART.exe	38
PID 548 wrote to memory of 592	548	AdobeART.exe	38
PID 548 wrote to memory of 592	548	AdobeART.exe	38
PID 548 wrote to memory of 592	548	AdobeART.exe	38
PID 548 wrote to memory of 592	548	AdobeART.exe	38
PID 548 wrote to memory of 592	548	AdobeART.exe	38
PID 592 wrote to memory of 1860	592	AdobeART.exe	39
PID 592 wrote to memory of 1860	592	AdobeART.exe	39
PID 592 wrote to memory of 1860	592	AdobeART.exe	39
PID 592 wrote to memory of 1860	592	AdobeART.exe	39
PID 1860 wrote to memory of 2252	1860	svhust.exe	40
PID 1860 wrote to memory of 2252	1860	svhust.exe	40
PID 1860 wrote to memory of 2252	1860	svhust.exe	40
PID 1860 wrote to memory of 2252	1860	svhust.exe	40
PID 1860 wrote to memory of 2252	1860	svhust.exe	40
PID 1860 wrote to memory of 2252	1860	svhust.exe	40
PID 1860 wrote to memory of 2252	1860	svhust.exe	40
PID 1860 wrote to memory of 2252	1860	svhust.exe	40
PID 1860 wrote to memory of 2780	1860	svhust.exe	41
PID 1860 wrote to memory of 2780	1860	svhust.exe	41
PID 1860 wrote to memory of 2780	1860	svhust.exe	41
PID 1860 wrote to memory of 2780	1860	svhust.exe	41

C:\Users\Admin\AppData\Local\Temp\e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
"C:\Users\Admin\AppData\Local\Temp\e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe
  "C:\Users\Admin\AppData\Local\Temp\e408a9c078f485154108ffd8ab9b5bcfca6853d19836d98ddad466bcad1d0650N.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\RHDYC.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:852
- - C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
    "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
      "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2320
  - - C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
      "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Users\Admin\AppData\Roaming\AdobeART.exe
        
        "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:548
      - C:\Users\Admin\AppData\Roaming\AdobeART.exe
        
        "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:592
        
        C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
        
        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
        
        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
        
        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Roaming\AdobeART.exe
        
        "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Roaming\AdobeART.exe
        
        "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
        
        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:264
        
        C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
        
        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:480
        
        C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
        
        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RHDYC.bat

Filesize
141B

MD5
e83a2e0b3c1e03dfb96ffd9924117a45

SHA1
27a3e4ba115ba1bad0bf094f5b97e768d1ece33e

SHA256
655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13

SHA512
5f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480

Download Submit
\Users\Admin\AppData\Roaming\svhust\svhust.exe

Filesize
152KB

MD5
752d9b9ad2b8b5ed735e6a02f26e6597

SHA1
d17053a03e66f1ee78919a8ac42d0a3077c60923

SHA256
99aa2e92096042135adf7aae1f5cdacd1f54ed78e16b0769b87dba605dc6448e

SHA512
96ba1ea319e8cd69b590f9d460ad4056b6ef1ee4f6f20e2582e484db2059a763e7b1d3ea2e043574ad20d52ede4803f9e782759b5b14c53ad8ef3bc02d5f6bb0

Download Submit
memory/480-2200-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/592-1484-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1688-773-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1764-2190-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1764-2201-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2252-2197-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2320-2196-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2516-776-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2516-361-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2660-20-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2660-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2660-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2660-10-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2660-16-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2780-1479-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2780-1495-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2944-2195-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2944-1810-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads