Analysis
-
max time kernel
20s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 14:55
Static task
static1
Behavioral task
behavioral1
Sample
8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe
Resource
win10v2004-20241007-en
General
-
Target
8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe
-
Size
112KB
-
MD5
c234d5c788e4339522f5a4d6214c6c26
-
SHA1
24263d8940ac1721167f50b9700d13db7e4d08ab
-
SHA256
8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24
-
SHA512
a067017c9fdc77384817691a612442e5255d85b7f2f56f4ea511e2227db881d946515d4768fd04175735c763dabf313addcc5655a694dab56d2e30618947ae0a
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJJ:tVIr7zI+fAceoGxSKKo5J
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral2/memory/800-67-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/800-68-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/800-76-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe -
Executes dropped EXE 3 IoCs
pid Process 4304 WAMain.exe 1896 WAMain.exe 800 WAMain.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1736 set thread context of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 set thread context of 4292 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 85 PID 4304 set thread context of 3672 4304 WAMain.exe 91 PID 4304 set thread context of 1896 4304 WAMain.exe 92 PID 4304 set thread context of 800 4304 WAMain.exe 93 -
resource yara_rule behavioral2/memory/4292-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4292-16-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4292-19-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4292-50-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/800-67-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/800-62-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/800-66-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/800-68-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4292-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1896-73-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/800-76-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe 4592 svchost.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1896 WAMain.exe Token: SeDebugPrivilege 1896 WAMain.exe Token: SeDebugPrivilege 1896 WAMain.exe Token: SeDebugPrivilege 1896 WAMain.exe Token: SeDebugPrivilege 1896 WAMain.exe Token: SeDebugPrivilege 1896 WAMain.exe Token: SeDebugPrivilege 1896 WAMain.exe Token: SeDebugPrivilege 1896 WAMain.exe Token: SeDebugPrivilege 1896 WAMain.exe Token: SeDebugPrivilege 1896 WAMain.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 4592 svchost.exe 4292 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 4304 WAMain.exe 3672 svchost.exe 1896 WAMain.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 1736 wrote to memory of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 wrote to memory of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 wrote to memory of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 wrote to memory of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 wrote to memory of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 wrote to memory of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 wrote to memory of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 wrote to memory of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 wrote to memory of 4592 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 84 PID 1736 wrote to memory of 4292 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 85 PID 1736 wrote to memory of 4292 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 85 PID 1736 wrote to memory of 4292 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 85 PID 1736 wrote to memory of 4292 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 85 PID 1736 wrote to memory of 4292 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 85 PID 1736 wrote to memory of 4292 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 85 PID 1736 wrote to memory of 4292 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 85 PID 1736 wrote to memory of 4292 1736 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 85 PID 4292 wrote to memory of 2916 4292 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 86 PID 4292 wrote to memory of 2916 4292 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 86 PID 4292 wrote to memory of 2916 4292 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 86 PID 2916 wrote to memory of 5056 2916 cmd.exe 89 PID 2916 wrote to memory of 5056 2916 cmd.exe 89 PID 2916 wrote to memory of 5056 2916 cmd.exe 89 PID 4292 wrote to memory of 4304 4292 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 90 PID 4292 wrote to memory of 4304 4292 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 90 PID 4292 wrote to memory of 4304 4292 8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe 90 PID 4304 wrote to memory of 3672 4304 WAMain.exe 91 PID 4304 wrote to memory of 3672 4304 WAMain.exe 91 PID 4304 wrote to memory of 3672 4304 WAMain.exe 91 PID 4304 wrote to memory of 3672 4304 WAMain.exe 91 PID 4304 wrote to memory of 3672 4304 WAMain.exe 91 PID 4304 wrote to memory of 3672 4304 WAMain.exe 91 PID 4304 wrote to memory of 3672 4304 WAMain.exe 91 PID 4304 wrote to memory of 3672 4304 WAMain.exe 91 PID 4304 wrote to memory of 3672 4304 WAMain.exe 91 PID 4304 wrote to memory of 1896 4304 WAMain.exe 92 PID 4304 wrote to memory of 1896 4304 WAMain.exe 92 PID 4304 wrote to memory of 1896 4304 WAMain.exe 92 PID 4304 wrote to memory of 1896 4304 WAMain.exe 92 PID 4304 wrote to memory of 1896 4304 WAMain.exe 92 PID 4304 wrote to memory of 1896 4304 WAMain.exe 92 PID 4304 wrote to memory of 1896 4304 WAMain.exe 92 PID 4304 wrote to memory of 1896 4304 WAMain.exe 92 PID 4304 wrote to memory of 800 4304 WAMain.exe 93 PID 4304 wrote to memory of 800 4304 WAMain.exe 93 PID 4304 wrote to memory of 800 4304 WAMain.exe 93 PID 4304 wrote to memory of 800 4304 WAMain.exe 93 PID 4304 wrote to memory of 800 4304 WAMain.exe 93 PID 4304 wrote to memory of 800 4304 WAMain.exe 93 PID 4304 wrote to memory of 800 4304 WAMain.exe 93 PID 4304 wrote to memory of 800 4304 WAMain.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe"C:\Users\Admin\AppData\Local\Temp\8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4592
-
-
C:\Users\Admin\AppData\Local\Temp\8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe"C:\Users\Admin\AppData\Local\Temp\8ee164f32bcb4be32198eaa47825fc59516220ccbf3c2fe1cb60bca1dfd15b24.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NMGPX.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5056
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3672
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1896
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD51ee769a102cbd69d164f60f82daf4323
SHA17ed9efde3a0a3ac9f6a54a46d047f7c6c9f199d1
SHA2564976c18ea1e14d5f9a36d2d246ce735a6a8737c09c2ddb06355d8a346a278f0c
SHA51231427e59ccf610b7caedd39aecd8d0936b8b0db4972ffdc2424909b85b17f2a416c3fff937067808ee7625bf578d83c4169f62bb5239689b32cbd20b0e78c790