Analysis
- max time kernel
150s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/12/2024, 04:02
General
- Target 29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331.cmd
- Size 2.8MB
- Sample241220-embfbszler
- SHA256 29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modiloader family
- ModiLoader Second Stage 61 IoCs
- Executes dropped EXE 8 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 92⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 93⤵
- Executes dropped EXE
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 122⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 123⤵
- Executes dropped EXE
-
-
-
C:\Users\Public\Libraries\spoolsv.COMC:\Users\Public\Libraries\spoolsv.COM2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\spoolsv.MPEG" / A / F / Q / S2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
spoolsv.COM
alpha.exe
kn.exe
spoolsv.MPEG
memory/1180-28-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-29-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-31-0x0000000000400000-0x0000000000502000-memory.dmp
memory/1180-33-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-36-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-35-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-41-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-48-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-63-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-104-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-77-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-103-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-76-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-99-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-98-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-73-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-72-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-96-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-95-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-71-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-93-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-69-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-91-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-90-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-67-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-86-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-64-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-62-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-61-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-58-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-101-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-57-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-74-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-55-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-94-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-54-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-70-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-92-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-52-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-51-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-68-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-66-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-49-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-65-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-85-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-83-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-47-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-46-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-60-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-59-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-45-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-75-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-56-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-44-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-53-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-43-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-50-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-42-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-40-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-39-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-38-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-37-0x0000000002A00000-0x0000000003A00000-memory.dmp
memory/1180-34-0x0000000002A00000-0x0000000003A00000-memory.dmp