Analysis
- max time kernel
119s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2025, 14:34
Behavioral task
behavioral1
Sample
7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
- Target 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe
- Size 90KB
- Sample250108-rxlehatld1
- SHA256 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9
- MD5 8da84f385dcb023494c1f9b474c7ed80
- SHA1 1572280eec5e8963941dc323abfbf446224c0fa4
- SHA512 1f3c6c137bce261e51f05910a4de5f95749f05e99fa9c399f4b26ec97d075406f41092a2d0b3fff7ba585f2bd91a6689efc419d75467d6ec0c38efe1d741457b
- SSDEEP 1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oD2:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3E
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modiloader family
- ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral2/memory/3668-53-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3668-56-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3668-55-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3668-61-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe - Executes dropped EXE 3 IoCs
pid Process 4024 csrsll.exe 1924 csrsll.exe 3668 csrsll.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1996 set thread context of 1952 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 86 PID 4024 set thread context of 1924 4024 csrsll.exe 95 PID 4024 set thread context of 3668 4024 csrsll.exe 96 -
resource yara_rule behavioral2/memory/1996-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1996-5-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1952-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1952-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1996-11-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1952-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1952-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000b000000023b76-29.dat upx behavioral2/memory/1952-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4024-40-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4024-41-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3668-46-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3668-50-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3668-53-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3668-56-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3668-55-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4024-54-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1952-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1924-60-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3668-61-0x0000000000400000-0x0000000000414000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrsll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe Token: SeDebugPrivilege 1924 csrsll.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 1952 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 4024 csrsll.exe 1924 csrsll.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1952 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 86 PID 1996 wrote to memory of 1952 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 86 PID 1996 wrote to memory of 1952 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 86 PID 1996 wrote to memory of 1952 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 86 PID 1996 wrote to memory of 1952 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 86 PID 1996 wrote to memory of 1952 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 86 PID 1996 wrote to memory of 1952 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 86 PID 1996 wrote to memory of 1952 1996 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 86 PID 1952 wrote to memory of 2140 1952 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 88 PID 1952 wrote to memory of 2140 1952 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 88 PID 1952 wrote to memory of 2140 1952 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 88 PID 2140 wrote to memory of 860 2140 cmd.exe 91 PID 2140 wrote to memory of 860 2140 cmd.exe 91 PID 2140 wrote to memory of 860 2140 cmd.exe 91 PID 1952 wrote to memory of 4024 1952 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 92 PID 1952 wrote to memory of 4024 1952 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 92 PID 1952 wrote to memory of 4024 1952 7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe 92 PID 4024 wrote to memory of 1924 4024 csrsll.exe 95 PID 4024 wrote to memory of 1924 4024 csrsll.exe 95 PID 4024 wrote to memory of 1924 4024 csrsll.exe 95 PID 4024 wrote to memory of 1924 4024 csrsll.exe 95 PID 4024 wrote to memory of 1924 4024 csrsll.exe 95 PID 4024 wrote to memory of 1924 4024 csrsll.exe 95 PID 4024 wrote to memory of 1924 4024 csrsll.exe 95 PID 4024 wrote to memory of 1924 4024 csrsll.exe 95 PID 4024 wrote to memory of 3668 4024 csrsll.exe 96 PID 4024 wrote to memory of 3668 4024 csrsll.exe 96 PID 4024 wrote to memory of 3668 4024 csrsll.exe 96 PID 4024 wrote to memory of 3668 4024 csrsll.exe 96 PID 4024 wrote to memory of 3668 4024 csrsll.exe 96 PID 4024 wrote to memory of 3668 4024 csrsll.exe 96 PID 4024 wrote to memory of 3668 4024 csrsll.exe 96 PID 4024 wrote to memory of 3668 4024 csrsll.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe"C:\Users\Admin\AppData\Local\Temp\7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe"C:\Users\Admin\AppData\Local\Temp\7205e133a9b7c9f1ad8906026dde21e3a03072d8d3448eb57ff853c0e8eca9e9N.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YFGDM.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:860
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3668
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\YFGDM.txt
- Size 145B
- SHA256 08375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
- MD5 4eb61ec7816c34ec8c125acadc57ec1b
- SHA1 b0015cc865c0bb1a027be663027d3829401a31cc
- SHA512 f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
- Size 90KB
- SHA256 4882cc5fb0663ecddb7009f97395e75378b264097c6479662daa59ff8a5f7770
- MD5 625b181b9ea378b9e56a83a344d59d82
- SHA1 284eb1553a4103844d5855179f5eefadd11addb3
- SHA512 30ee9cb334567fe7a703a598ea0d6e3c4e31b039b47cfdf75eed47cfc383bf09527825c3f1c408514fc38f01e5db87dcccb9c3a528564dbfcffe0ad228a1fafb
- SSDEEP 1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDU:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3G
- MD5 SHA1 SHA512 SSDEEP