Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 01:42
Behavioral task
behavioral1
Sample
893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe
Resource
win10v2004-20241007-en
General
-
Target
893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe
-
Size
90KB
-
MD5
c10fc9778e1c16da233f5c3567c44180
-
SHA1
512ed1dd711f4e58ca5e82b1771547aae8b25427
-
SHA256
893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19ee
-
SHA512
a112a705fc7dd58bc3250e5f96a51ee70f15097b60070bd9ec00f7c527483a6e0980c40e8a81bd46faeb1a423c89b33da737e8d33e0ba2c414947c9ea55812b1
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDq:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3g
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral2/memory/1688-56-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1688-55-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1688-51-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1688-61-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe -
Executes dropped EXE 3 IoCs
pid Process 2684 csrsll.exe 2388 csrsll.exe 1688 csrsll.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4864 set thread context of 3084 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 82 PID 2684 set thread context of 2388 2684 csrsll.exe 88 PID 2684 set thread context of 1688 2684 csrsll.exe 89 -
resource yara_rule behavioral2/memory/4864-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4864-5-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3084-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3084-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4864-12-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3084-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b69-29.dat upx behavioral2/memory/3084-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2684-40-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2684-41-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1688-46-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1688-56-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1688-55-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2684-54-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1688-51-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3084-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2388-60-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1688-61-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe Token: SeDebugPrivilege 2388 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 3084 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 2684 csrsll.exe 2388 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3084 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 82 PID 4864 wrote to memory of 3084 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 82 PID 4864 wrote to memory of 3084 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 82 PID 4864 wrote to memory of 3084 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 82 PID 4864 wrote to memory of 3084 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 82 PID 4864 wrote to memory of 3084 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 82 PID 4864 wrote to memory of 3084 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 82 PID 4864 wrote to memory of 3084 4864 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 82 PID 3084 wrote to memory of 864 3084 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 83 PID 3084 wrote to memory of 864 3084 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 83 PID 3084 wrote to memory of 864 3084 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 83 PID 864 wrote to memory of 4456 864 cmd.exe 86 PID 864 wrote to memory of 4456 864 cmd.exe 86 PID 864 wrote to memory of 4456 864 cmd.exe 86 PID 3084 wrote to memory of 2684 3084 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 87 PID 3084 wrote to memory of 2684 3084 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 87 PID 3084 wrote to memory of 2684 3084 893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe 87 PID 2684 wrote to memory of 2388 2684 csrsll.exe 88 PID 2684 wrote to memory of 2388 2684 csrsll.exe 88 PID 2684 wrote to memory of 2388 2684 csrsll.exe 88 PID 2684 wrote to memory of 2388 2684 csrsll.exe 88 PID 2684 wrote to memory of 2388 2684 csrsll.exe 88 PID 2684 wrote to memory of 2388 2684 csrsll.exe 88 PID 2684 wrote to memory of 2388 2684 csrsll.exe 88 PID 2684 wrote to memory of 2388 2684 csrsll.exe 88 PID 2684 wrote to memory of 1688 2684 csrsll.exe 89 PID 2684 wrote to memory of 1688 2684 csrsll.exe 89 PID 2684 wrote to memory of 1688 2684 csrsll.exe 89 PID 2684 wrote to memory of 1688 2684 csrsll.exe 89 PID 2684 wrote to memory of 1688 2684 csrsll.exe 89 PID 2684 wrote to memory of 1688 2684 csrsll.exe 89 PID 2684 wrote to memory of 1688 2684 csrsll.exe 89 PID 2684 wrote to memory of 1688 2684 csrsll.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe"C:\Users\Admin\AppData\Local\Temp\893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe"C:\Users\Admin\AppData\Local\Temp\893fdee34f840a656b3bbd31d54658744159eefe06b60741c9e00084b10f19eeN.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RCAEH.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4456
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2388
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1688
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
90KB
MD59da2b7b080c2d1a1b0fb1fa6c4c01d38
SHA167c777a43b36fed0cf3201677b10da7e7e355567
SHA256e8c4b33088b5adf673386a2587a9ef50dc05b7c39afce14d4610a785d5f5befa
SHA5125e81045d18464d843e5cec95c828e779e92351ab2eb9ff28fdbb718fab266b7be2961624bd7f75aeffcf9d6bd01cf35fd7bac423327fd58f2ff8dd4deed4c5d0