Analysis
-
max time kernel
149s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
05-01-2025 22:52
General
-
Target
3b816289e55f706a7e27ae4edad5e1547463aa5e17de3edf68272e8aeb6a8870.exe
-
Size
90KB
-
MD5
daa9b91138417dbbb34a24882c394eff
-
SHA1
3956ef8c784d78643da8345d44f2d3b6583a21bb
-
SHA256
3b816289e55f706a7e27ae4edad5e1547463aa5e17de3edf68272e8aeb6a8870
-
SHA512
0d90df6d3b230ced2054a3322dcf669a6fcc3c8dbda890a50b2ab02fe6a326b7a3b68dbf230907d017dcaa26a2cd15f5b6643233b5d3d63d75bf830dc2f444f5
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDI:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3i
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b816289e55f706a7e27ae4edad5e1547463aa5e17de3edf68272e8aeb6a8870.exe"C:\Users\Admin\AppData\Local\Temp\3b816289e55f706a7e27ae4edad5e1547463aa5e17de3edf68272e8aeb6a8870.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b816289e55f706a7e27ae4edad5e1547463aa5e17de3edf68272e8aeb6a8870.exe"C:\Users\Admin\AppData\Local\Temp\3b816289e55f706a7e27ae4edad5e1547463aa5e17de3edf68272e8aeb6a8870.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\NIGXV.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
90KB
MD51d3f158da385e73abc6173fade70d766
SHA1e50f645b3dbddbac4e0673c67b9d75c027150460
SHA25640e5a7a8fd8c642aa945550edb48a358e907021fa2b6e29109e9ed2c9d5dcdbc
SHA51281e55f222be88f03983e5875e4839c5304effef6b271adb55e761ddcdee5f74a3a1615795e0f3e60d3fdcfb76da5a32c5e03284306fb0055efff7f84fe46b275
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
332KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
332KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
332KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB