Analysis
-
max time kernel
108s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 10:01
Static task
static1
Behavioral task
behavioral1
Sample
Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe
Resource
win10v2004-20241007-en
General
-
Target
Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe
-
Size
1.3MB
-
MD5
09f4f91713bd6588465534822d5ad96c
-
SHA1
3b6b69c8709aea821d60248294d52e3cfefecb23
-
SHA256
c8e0836b1e1ea4ee7486eb41994ae198cb5f60f460dc4cbefbbabc186329855f
-
SHA512
8b6b9ad29f50a6e141c8a3033d0f668abf63207497ec4a8ba469d5ce08a2ab9a93a06c66cc2e57e614a45d0e188eb0a6f5e94e578c3525c127a4e288a494a774
-
SSDEEP
24576:9dk7eYEWx0i5VTe5QCQBSt2jKasCr4LUkq0uHyC6q7KubU+7:90eYbSGUelD0uSC6q7bbU+
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral2/memory/5012-2-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-12-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-19-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-31-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-47-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-66-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-65-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-64-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-63-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-61-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-60-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-59-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-58-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-56-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-55-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-54-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-53-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-51-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-46-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-44-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-43-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-62-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-39-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-37-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-57-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-35-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-34-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-33-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-52-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-32-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-50-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-49-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-30-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-48-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-29-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-28-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-45-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-27-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-26-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-42-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-41-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-25-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-40-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-24-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-38-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-23-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-36-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-22-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-21-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-20-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-18-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-17-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-16-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-15-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-14-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-13-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-11-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-10-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-9-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-7-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 behavioral2/memory/5012-8-0x0000000002C70000-0x0000000003C70000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 4372 hdcleziT.pif -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tizelcdh = "C:\\Users\\Public\\Tizelcdh.url" Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 12 drive.google.com 14 drive.google.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5012 set thread context of 4372 5012 Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdcleziT.pif -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 14 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif 4372 hdcleziT.pif -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5012 wrote to memory of 3680 5012 Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe 84 PID 5012 wrote to memory of 3680 5012 Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe 84 PID 5012 wrote to memory of 3680 5012 Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe 84 PID 5012 wrote to memory of 4372 5012 Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe 87 PID 5012 wrote to memory of 4372 5012 Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe 87 PID 5012 wrote to memory of 4372 5012 Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe 87 PID 5012 wrote to memory of 4372 5012 Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe 87 PID 5012 wrote to memory of 4372 5012 Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe"C:\Users\Admin\AppData\Local\Temp\Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd2⤵
- System Location Discovery: System Language Discovery
PID:3680
-
-
C:\Users\Public\Libraries\hdcleziT.pifC:\Users\Public\Libraries\hdcleziT.pif2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD560cd0be570decd49e4798554639a05ae
SHA1bd7bed69d9ab9a20b5263d74921c453f38477bcb
SHA256ca6a6c849496453990beceef8c192d90908c0c615fa0a1d01bcd464bad6966a5
SHA512ab3dbdb4ed95a0cb4072b23dd241149f48ecff8a69f16d81648e825d9d81a55954e5dd9bc46d3d7408421df30c901b9ad1385d1e70793fa8d715c86c9e800c57
-
Filesize
171KB
MD522331abcc9472cc9dc6f37faf333aa2c
SHA12a001c30ba79a19ceaf6a09c3567c70311760aa4
SHA256bdfa725ec2a2c8ea5861d9b4c2f608e631a183fca7916c1e07a28b656cc8ec0c
SHA512c7f5baad732424b975a426867d3d8b5424aa830aa172ed0ff0ef630070bf2b4213750e123a36d8c5a741e22d3999ca1d7e77c62d4b77d6295b20a38114b7843c