Analysis
-
max time kernel
114s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 10:31
Static task
static1
Behavioral task
behavioral1
Sample
RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe
Resource
win10v2004-20241007-en
General
-
Target
RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe
-
Size
1.5MB
-
MD5
aaca1b72e0ac5dc118b0f981667e8179
-
SHA1
162a85d0d2d6eec0fb05d043167bbd8451183735
-
SHA256
8a63bbd795519e52538e95891f205d78a4ccc474c24e80d8efab364ad4ca2335
-
SHA512
b066f98aa3ff546753e6ac2cc76918ab90b46859ecadb7b1940bf562edbb389383f2a09146b71863073c3434a408daf5fa93968603011d647ede2aa9c9e13426
-
SSDEEP
24576:ybzkvy/WQ9JGhRg8MLr12geV421wu0L8UnE923HZshmMv6J:ybzgZh+HV21W8UE923HZrs6
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral2/memory/4272-2-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-11-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-21-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-45-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-65-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-64-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-63-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-62-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-60-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-59-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-58-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-57-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-56-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-55-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-53-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-51-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-50-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-49-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-48-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-47-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-46-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-44-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-43-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-42-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-41-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-39-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-38-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-35-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-34-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-32-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-31-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-30-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-61-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-27-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-54-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-52-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-24-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-23-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-22-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-20-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-40-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-18-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-37-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-17-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-36-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-16-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-33-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-15-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-29-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-14-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-28-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-26-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-13-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-25-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-12-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-19-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-10-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-9-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-8-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-7-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/4272-6-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 3768 kmtqwssC.pif -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Csswqtmk = "C:\\Users\\Public\\Csswqtmk.url" RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 15 drive.google.com 17 drive.google.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4272 set thread context of 3768 4272 RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe 88 -
Program crash 1 IoCs
pid pid_target Process procid_target 3628 3768 WerFault.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 17 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4272 wrote to memory of 904 4272 RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe 86 PID 4272 wrote to memory of 904 4272 RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe 86 PID 4272 wrote to memory of 904 4272 RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe 86 PID 4272 wrote to memory of 3768 4272 RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe 88 PID 4272 wrote to memory of 3768 4272 RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe 88 PID 4272 wrote to memory of 3768 4272 RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe 88 PID 4272 wrote to memory of 3768 4272 RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe 88 PID 4272 wrote to memory of 3768 4272 RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe"C:\Users\Admin\AppData\Local\Temp\RTD20241038IIListedPartsAndQuotationRequestpdf.scr.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd2⤵
- System Location Discovery: System Language Discovery
PID:904
-
-
C:\Users\Public\Libraries\kmtqwssC.pifC:\Users\Public\Libraries\kmtqwssC.pif2⤵
- Executes dropped EXE
PID:3768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 123⤵
- Program crash
PID:3628
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3768 -ip 37681⤵PID:3268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD560cd0be570decd49e4798554639a05ae
SHA1bd7bed69d9ab9a20b5263d74921c453f38477bcb
SHA256ca6a6c849496453990beceef8c192d90908c0c615fa0a1d01bcd464bad6966a5
SHA512ab3dbdb4ed95a0cb4072b23dd241149f48ecff8a69f16d81648e825d9d81a55954e5dd9bc46d3d7408421df30c901b9ad1385d1e70793fa8d715c86c9e800c57
-
Filesize
171KB
MD522331abcc9472cc9dc6f37faf333aa2c
SHA12a001c30ba79a19ceaf6a09c3567c70311760aa4
SHA256bdfa725ec2a2c8ea5861d9b4c2f608e631a183fca7916c1e07a28b656cc8ec0c
SHA512c7f5baad732424b975a426867d3d8b5424aa830aa172ed0ff0ef630070bf2b4213750e123a36d8c5a741e22d3999ca1d7e77c62d4b77d6295b20a38114b7843c