Overview

overview

10

Static

static

3

9b588bd7ec...e8.exe

windows7-x64

10

9b588bd7ec...e8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2024, 05:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe

  • Size

    844KB

  • MD5

    fe6a56dc172084614756a632ce537ffb

  • SHA1

    d91a9e15734a82cb06cdb6b3fc169c4b1b882cfe

  • SHA256

    9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8

  • SHA512

    060293686abeb1291f8b7dcce48463499afca9afc7b3c79e207b7929906d7a43a17d0cbf5087c267d2b0d90ec4978dfa92c4a3d27b96effda37d5755bb5dc122

  • SSDEEP

    24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qdv:3X05Jm7sAKF0GELm8IDVGqQVZ

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 50 IoCs
    persistence
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe
    "C:\Users\Admin\AppData\Local\Temp\9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Users\Admin\srRTMxaDv9.exe
      C:\Users\Admin\srRTMxaDv9.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Users\Admin\dwcen.exe
        "C:\Users\Admin\dwcen.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4736
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3668
    • C:\Users\Admin\amhost.exe
      C:\Users\Admin\amhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3896
      • C:\Users\Admin\amhost.exe
        amhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2092
    • C:\Users\Admin\bmhost.exe
      C:\Users\Admin\bmhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4968
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
          PID:2688
      • C:\Users\Admin\cmhost.exe
        C:\Users\Admin\cmhost.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1120
        • C:\Users\Admin\AppData\Local\1cf5d2a5\X
          176.53.17.24:80
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3464
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            4⤵
            • Modifies registry class
            PID:2168
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
            PID:4216
        • C:\Users\Admin\dmhost.exe
          C:\Users\Admin\dmhost.exe
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4132
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del 9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:320
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3576

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\1cf5d2a5\X
              Filesize

              41KB

              MD5

              be40a2578e862f1cecc9b9194f524201

              SHA1

              0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

              SHA256

              2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

              SHA512

              25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

              Download Submit

            • C:\Users\Admin\amhost.exe
              Filesize

              80KB

              MD5

              8ccbe4f27f9710f3e7f75e1d1de57e49

              SHA1

              272e95e476477cd4a1715ee0bcf32318e0351718

              SHA256

              3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

              SHA512

              334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

              Download Submit

            • C:\Users\Admin\bmhost.exe
              Filesize

              258KB

              MD5

              2da0070a7c50f3a078b73b4fb7ee7c02

              SHA1

              999b4860a80b908622fadfc8fae27db66b200932

              SHA256

              f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

              SHA512

              2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

              Download Submit

            • C:\Users\Admin\cmhost.exe
              Filesize

              358KB

              MD5

              03102e4338eb16e0c4dfe106830557e3

              SHA1

              4fdb5baf0900e44e95acdeee1c947be3b0518b39

              SHA256

              7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

              SHA512

              c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

              Download Submit

            • C:\Users\Admin\dmhost.exe
              Filesize

              32KB

              MD5

              b6a9b71e9f58a91b88fcb5f813f2b6bd

              SHA1

              682ee0b10f1f42c6b4cf67ab46d92e8e9b57db96

              SHA256

              f2b2f7e8dcbdc65693f8b279bea9b970163662fc77a61a024ef2f6267a7f4b41

              SHA512

              40a334f0631d2ba246d52752ac61469e05c2847a31450d04157ec9daba40f48ca2e68554c7a61e58e822575c8550f41b98b4e5e1b8bb2622285f30548af8f046

              Download Submit

            • C:\Users\Admin\dwcen.exe
              Filesize

              344KB

              MD5

              8f9be51f1037ecbdaeaacedfab4ba684

              SHA1

              e5cbed44d09be847d91d1da0992f0da0f593f611

              SHA256

              3abb418e61371c4453292a9890adddfbe478e89236145b2aa7059be86827ccc3

              SHA512

              d2f5944be6bf9f42d7290f6d8f5af3d1cbcf69f2dfe10953f7e4cabd401530a5838ddb4a0f043e90fd6942f3538fb334e1566fc893928ab20d4d558e7187ebe7

              Download Submit

            • C:\Users\Admin\srRTMxaDv9.exe
              Filesize

              344KB

              MD5

              57a5743f47b3a874773041195600909c

              SHA1

              74f5c16a6ca03baea7c684e40d351f1ec484a70d

              SHA256

              eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

              SHA512

              66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

              Download Submit

            • memory/1120-81-0x0000000000400000-0x0000000000465C48-memory.dmp

              Filesize

              407KB

              Download

            • memory/1120-73-0x0000000000400000-0x0000000000465C48-memory.dmp

              Filesize

              407KB

              Download

            • memory/2092-51-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2092-52-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2092-53-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2092-46-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2092-45-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/3896-50-0x0000000000400000-0x0000000000417000-memory.dmp

              Filesize

              92KB

              Download

            • memory/4968-57-0x0000000000400000-0x0000000000446000-memory.dmp

              Filesize

              280KB

              Download