modiloader | 9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2024, 05:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe
Size

844KB
MD5

fe6a56dc172084614756a632ce537ffb
SHA1

d91a9e15734a82cb06cdb6b3fc169c4b1b882cfe
SHA256

9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8
SHA512

060293686abeb1291f8b7dcce48463499afca9afc7b3c79e207b7929906d7a43a17d0cbf5087c267d2b0d90ec4978dfa92c4a3d27b96effda37d5755bb5dc122
SSDEEP

24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qdv:3X05Jm7sAKF0GELm8IDVGqQVZ

Score

10^/10

modiloader discovery evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kouat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	srRTMxaDv9.exe

Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001e767-38.dat	modiloader_stage2
behavioral2/memory/4408-53-0x0000000000400000-0x0000000000417000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	srRTMxaDv9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe

Executes dropped EXE 8 IoCs

pid	Process
1580	srRTMxaDv9.exe
4408	amhost.exe
4600	kouat.exe
4784	amhost.exe
4368	bmhost.exe
768	cmhost.exe
4772	X
692	dmhost.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /Z"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /n"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /x"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /I"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /v"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /R"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /j"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /J"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /e"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /s"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /m"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /b"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /u"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /s"	srRTMxaDv9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /l"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /i"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /U"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /d"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /S"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /F"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /c"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /y"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /M"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /N"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /H"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /A"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /g"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /h"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /P"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /w"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /E"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /T"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /X"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /Q"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /q"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /p"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /f"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /L"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /K"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /D"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /C"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /z"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /t"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /O"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /k"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /W"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /V"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /o"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /a"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /G"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /Y"	kouat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouat = "C:\\Users\\Admin\\kouat.exe /B"	kouat.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2800	tasklist.exe
1580	tasklist.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4408 set thread context of 4784	4408	amhost.exe	92
PID 4368 set thread context of 4420	4368	bmhost.exe	94
PID 768 set thread context of 5076	768	cmhost.exe	111

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4784-45-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4784-52-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4784-50-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4784-49-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4784-46-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srRTMxaDv9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bmhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dmhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kouat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmhost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1580	srRTMxaDv9.exe
1580	srRTMxaDv9.exe
1580	srRTMxaDv9.exe
1580	srRTMxaDv9.exe
4784	amhost.exe
4784	amhost.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4784	amhost.exe
4784	amhost.exe
4600	kouat.exe
4600	kouat.exe
4772	X
4772	X
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4784	amhost.exe
4784	amhost.exe
4600	kouat.exe
4600	kouat.exe
4784	amhost.exe
4784	amhost.exe
4784	amhost.exe
4784	amhost.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4784	amhost.exe
4784	amhost.exe
4600	kouat.exe
4600	kouat.exe
4784	amhost.exe
4784	amhost.exe
4784	amhost.exe
4784	amhost.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4600	kouat.exe
4784	amhost.exe
4784	amhost.exe
4784	amhost.exe
4784	amhost.exe
4600	kouat.exe
4600	kouat.exe
4784	amhost.exe
4784	amhost.exe
4600	kouat.exe
4600	kouat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	4368	bmhost.exe
Token: SeDebugPrivilege	768	cmhost.exe
Token: SeDebugPrivilege	1580	tasklist.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe
1580	srRTMxaDv9.exe
4600	kouat.exe
692	dmhost.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1580	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	83
PID 4352 wrote to memory of 1580	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	83
PID 4352 wrote to memory of 1580	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	83
PID 4352 wrote to memory of 4408	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	85
PID 4352 wrote to memory of 4408	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	85
PID 4352 wrote to memory of 4408	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	85
PID 1580 wrote to memory of 4600	1580	srRTMxaDv9.exe	86
PID 1580 wrote to memory of 4600	1580	srRTMxaDv9.exe	86
PID 1580 wrote to memory of 4600	1580	srRTMxaDv9.exe	86
PID 1580 wrote to memory of 4168	1580	srRTMxaDv9.exe	87
PID 1580 wrote to memory of 4168	1580	srRTMxaDv9.exe	87
PID 1580 wrote to memory of 4168	1580	srRTMxaDv9.exe	87
PID 4168 wrote to memory of 2800	4168	cmd.exe	89
PID 4168 wrote to memory of 2800	4168	cmd.exe	89
PID 4168 wrote to memory of 2800	4168	cmd.exe	89
PID 4408 wrote to memory of 4784	4408	amhost.exe	92
PID 4408 wrote to memory of 4784	4408	amhost.exe	92
PID 4408 wrote to memory of 4784	4408	amhost.exe	92
PID 4408 wrote to memory of 4784	4408	amhost.exe	92
PID 4408 wrote to memory of 4784	4408	amhost.exe	92
PID 4408 wrote to memory of 4784	4408	amhost.exe	92
PID 4408 wrote to memory of 4784	4408	amhost.exe	92
PID 4408 wrote to memory of 4784	4408	amhost.exe	92
PID 4352 wrote to memory of 4368	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	93
PID 4352 wrote to memory of 4368	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	93
PID 4352 wrote to memory of 4368	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	93
PID 4368 wrote to memory of 4420	4368	bmhost.exe	94
PID 4368 wrote to memory of 4420	4368	bmhost.exe	94
PID 4368 wrote to memory of 4420	4368	bmhost.exe	94
PID 4368 wrote to memory of 4420	4368	bmhost.exe	94
PID 4352 wrote to memory of 768	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	96
PID 4352 wrote to memory of 768	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	96
PID 4352 wrote to memory of 768	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	96
PID 768 wrote to memory of 4772	768	cmhost.exe	97
PID 768 wrote to memory of 4772	768	cmhost.exe	97
PID 4772 wrote to memory of 972	4772	X	98
PID 4772 wrote to memory of 972	4772	X	98
PID 4772 wrote to memory of 972	4772	X	98
PID 768 wrote to memory of 5076	768	cmhost.exe	111
PID 768 wrote to memory of 5076	768	cmhost.exe	111
PID 768 wrote to memory of 5076	768	cmhost.exe	111
PID 768 wrote to memory of 5076	768	cmhost.exe	111
PID 4352 wrote to memory of 692	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	113
PID 4352 wrote to memory of 692	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	113
PID 4352 wrote to memory of 692	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	113
PID 4352 wrote to memory of 3120	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	117
PID 4352 wrote to memory of 3120	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	117
PID 4352 wrote to memory of 3120	4352	9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe	117
PID 3120 wrote to memory of 1580	3120	cmd.exe	119
PID 3120 wrote to memory of 1580	3120	cmd.exe	119
PID 3120 wrote to memory of 1580	3120	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe
"C:\Users\Admin\AppData\Local\Temp\9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\srRTMxaDv9.exe
  C:\Users\Admin\srRTMxaDv9.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Users\Admin\kouat.exe
    "C:\Users\Admin\kouat.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- C:\Users\Admin\amhost.exe
  C:\Users\Admin\amhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Users\Admin\amhost.exe
    amhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4784
- C:\Users\Admin\bmhost.exe
  C:\Users\Admin\bmhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:4420
- C:\Users\Admin\cmhost.exe
  C:\Users\Admin\cmhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Users\Admin\AppData\Local\9bc77bf5\X
    176.53.17.24:80
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      Modifies registry class
      PID:972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:5076
- C:\Users\Admin\dmhost.exe
  C:\Users\Admin\dmhost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del 9b588bd7ecc4485abb18702bebc40ddbd38feb7fa25bf484af426fb070562be8.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\9bc77bf5\X

Filesize
41KB

MD5
be40a2578e862f1cecc9b9194f524201

SHA1
0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

SHA256
2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

SHA512
25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

Download Submit
C:\Users\Admin\amhost.exe

Filesize
80KB

MD5
8ccbe4f27f9710f3e7f75e1d1de57e49

SHA1
272e95e476477cd4a1715ee0bcf32318e0351718

SHA256
3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

SHA512
334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

Download Submit
C:\Users\Admin\bmhost.exe

Filesize
258KB

MD5
2da0070a7c50f3a078b73b4fb7ee7c02

SHA1
999b4860a80b908622fadfc8fae27db66b200932

SHA256
f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

SHA512
2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

Download Submit
C:\Users\Admin\cmhost.exe

Filesize
358KB

MD5
03102e4338eb16e0c4dfe106830557e3

SHA1
4fdb5baf0900e44e95acdeee1c947be3b0518b39

SHA256
7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

SHA512
c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

Download Submit
C:\Users\Admin\dmhost.exe

Filesize
32KB

MD5
b6a9b71e9f58a91b88fcb5f813f2b6bd

SHA1
682ee0b10f1f42c6b4cf67ab46d92e8e9b57db96

SHA256
f2b2f7e8dcbdc65693f8b279bea9b970163662fc77a61a024ef2f6267a7f4b41

SHA512
40a334f0631d2ba246d52752ac61469e05c2847a31450d04157ec9daba40f48ca2e68554c7a61e58e822575c8550f41b98b4e5e1b8bb2622285f30548af8f046

Download Submit
C:\Users\Admin\kouat.exe

Filesize
344KB

MD5
484cae380f3db68908ca05ba4f776f40

SHA1
a2fd7514d00ca6baa54ffdecba7f2526d0b02329

SHA256
7886e1e7f370827880d717dc6ef0be2f7266298b22c96a084f2b18bdeb1edec5

SHA512
8554af1b1b418dd60010d60d8a66c5d534e7401b8f831240c48c402005aeef2b3bcd6bdc6b51ce896ce7af9582a452d38c527a9f3a4584da2bea84bc5e5c7218

Download Submit
C:\Users\Admin\srRTMxaDv9.exe

Filesize
344KB

MD5
57a5743f47b3a874773041195600909c

SHA1
74f5c16a6ca03baea7c684e40d351f1ec484a70d

SHA256
eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

SHA512
66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

Download Submit
memory/768-82-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/768-74-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/4368-58-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4408-53-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4784-52-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4784-46-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4784-49-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4784-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4784-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download