Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5bce9617c0...aN.exe

windows7-x64

10

5bce9617c0...aN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 23:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe

  • Size

    844KB

  • MD5

    629379e39d21a96f0f047ae336dd78d0

  • SHA1

    3d8a5caf3514bac334189eb8884518e176d5dabe

  • SHA256

    5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6a

  • SHA512

    ff48b2fd8351c8ee31b76d82f5e683816dca9a9421dd1a43f8420772169ac8457fff34e2c359e7b4549a0fa3a730ca15f6395fee50153c0fde66ba4ea793cc16

  • SSDEEP

    24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 16 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:336
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:856
    • C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      2⤵
        PID:1348
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      PID:1176
      • C:\Users\Admin\AppData\Local\Temp\5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe
        "C:\Users\Admin\AppData\Local\Temp\5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\Users\Admin\srRTMxaDv9.exe
          C:\Users\Admin\srRTMxaDv9.exe
          3⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2076
          • C:\Users\Admin\zoeko.exe
            "C:\Users\Admin\zoeko.exe"
            4⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2360
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2508
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2808
        • C:\Users\Admin\amhost.exe
          C:\Users\Admin\amhost.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Users\Admin\amhost.exe
            amhost.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2900
        • C:\Users\Admin\bmhost.exe
          C:\Users\Admin\bmhost.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:400
        • C:\Users\Admin\cmhost.exe
          C:\Users\Admin\cmhost.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1672
          • C:\Users\Admin\AppData\Local\a0440614\X
            176.53.17.24:80
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2320
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:108
        • C:\Users\Admin\dmhost.exe
          C:\Users\Admin\dmhost.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:824
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe
          3⤵
          • Deletes itself
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:708
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1692

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\a0440614\@
      Filesize

      2KB

      MD5

      f5e66a93bc297ba83db0e7b5564ced3f

      SHA1

      863c519546cfba7531b8ecbf10ae5bede6d2193d

      SHA256

      94257ae4c040d8487cb44bc23030193944c72c12678dcd8b80684a3721b21231

      SHA512

      b7ee82bdc3057df90eed61a9d0d6d52420fb8baf6cc8f12f30144ecdd1f298f13d89e14bfa474ea939bd734440f185d7bba72d1140080a3ef975253191adaea3

      Download Submit

    • \??\globalroot\systemroot\assembly\temp\@
      Filesize

      2KB

      MD5

      437156e529053ac020da405e7c0c512f

      SHA1

      7a9aaec69647e5447371103631dc87881863418f

      SHA256

      5e2c06ad23798a20a2e312ed1ec5e9a31764d8045e304f3fd07a2103ea94bc0d

      SHA512

      03684d90683c62270000eeb9d543213e2564cd1c05bf4efd38384230f2a25040d8f052ccfd90c88232669e4f70df32592ad69af2f6d536ba768545a71c219edd

      Download Submit

    • \Users\Admin\AppData\Local\a0440614\X
      Filesize

      41KB

      MD5

      be40a2578e862f1cecc9b9194f524201

      SHA1

      0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

      SHA256

      2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

      SHA512

      25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

      Download Submit

    • \Users\Admin\amhost.exe
      Filesize

      80KB

      MD5

      8ccbe4f27f9710f3e7f75e1d1de57e49

      SHA1

      272e95e476477cd4a1715ee0bcf32318e0351718

      SHA256

      3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

      SHA512

      334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

      Download Submit

    • \Users\Admin\bmhost.exe
      Filesize

      258KB

      MD5

      2da0070a7c50f3a078b73b4fb7ee7c02

      SHA1

      999b4860a80b908622fadfc8fae27db66b200932

      SHA256

      f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

      SHA512

      2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

      Download Submit

    • \Users\Admin\cmhost.exe
      Filesize

      358KB

      MD5

      03102e4338eb16e0c4dfe106830557e3

      SHA1

      4fdb5baf0900e44e95acdeee1c947be3b0518b39

      SHA256

      7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

      SHA512

      c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

      Download Submit

    • \Users\Admin\dmhost.exe
      Filesize

      32KB

      MD5

      b6a9b71e9f58a91b88fcb5f813f2b6bd

      SHA1

      682ee0b10f1f42c6b4cf67ab46d92e8e9b57db96

      SHA256

      f2b2f7e8dcbdc65693f8b279bea9b970163662fc77a61a024ef2f6267a7f4b41

      SHA512

      40a334f0631d2ba246d52752ac61469e05c2847a31450d04157ec9daba40f48ca2e68554c7a61e58e822575c8550f41b98b4e5e1b8bb2622285f30548af8f046

      Download Submit

    • \Users\Admin\srRTMxaDv9.exe
      Filesize

      344KB

      MD5

      57a5743f47b3a874773041195600909c

      SHA1

      74f5c16a6ca03baea7c684e40d351f1ec484a70d

      SHA256

      eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

      SHA512

      66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

      Download Submit

    • \Users\Admin\zoeko.exe
      Filesize

      344KB

      MD5

      49a03b3e61801617251172eace3e1482

      SHA1

      40a7339d25959ccdf7078288c7ae2c75d83be233

      SHA256

      e9cf523409136fa869ab487b4a348e9e7b82b71bf4aa2c65c5072d00f841cf04

      SHA512

      b695ee74635501c261bfe7b0d4fbe70d0181d799ffced04045e4c252980221841044a2229d11f2160d3c0b8cf9b120355e04cb6267b80f9815c6f1d44e2bdd4a

      Download Submit

    • \Windows\System32\consrv.dll
      Filesize

      53KB

      MD5

      4d7cde615a0f534bd5e359951829554b

      SHA1

      c885d00d9000f2a5dbc78f6193a052b36f4fe968

      SHA256

      414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

      SHA512

      33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

      Download Submit

    • \Windows\assembly\GAC_32\Desktop.ini
      Filesize

      4KB

      MD5

      878f9b6da85cb98fcbdf6abd1730a32f

      SHA1

      343007e658ea541f4680b4edf4513e69e1cc18a6

      SHA256

      75b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d

      SHA512

      5425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293

      Download Submit

    • \Windows\assembly\GAC_64\Desktop.ini
      Filesize

      5KB

      MD5

      9d7ec1e355ac35cbe6991721ef5ae3b8

      SHA1

      c35a00bd35c6e4a7516b93947be08ead966347e8

      SHA256

      68a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98

      SHA512

      b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0

      Download Submit

    • memory/336-87-0x0000000002300000-0x0000000002312000-memory.dmp

      Filesize

      72KB

      Download

    • memory/1176-111-0x0000000002D40000-0x0000000002D4B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1176-115-0x0000000002D40000-0x0000000002D4B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1176-121-0x0000000002D50000-0x0000000002D5B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1176-120-0x0000000002D40000-0x0000000002D4B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1176-81-0x00000000025E0000-0x00000000025E6000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1176-77-0x00000000025E0000-0x00000000025E6000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1176-73-0x00000000025E0000-0x00000000025E6000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1672-128-0x0000000000400000-0x0000000000465C48-memory.dmp

      Filesize

      407KB

      Download

    • memory/1672-136-0x0000000000400000-0x0000000000465C48-memory.dmp

      Filesize

      407KB

      Download

    • memory/2660-72-0x0000000000390000-0x00000000003D1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2660-91-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2660-60-0x0000000000390000-0x00000000003D1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2660-64-0x0000000000390000-0x00000000003D1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2660-69-0x0000000000390000-0x00000000003D1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2660-68-0x0000000000390000-0x00000000003D1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2660-70-0x0000000000390000-0x00000000003D1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2668-46-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

      Download

    • memory/2900-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2900-48-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2900-50-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2900-51-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2900-52-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2900-36-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2900-38-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2900-40-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download