Analysis
-
max time kernel
98s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/01/2025, 01:30
Static task
static1
Behavioral task
behavioral1
Sample
ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe
Resource
win10v2004-20241007-en
General
-
Target
ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe
-
Size
834KB
-
MD5
f05fa97176c0cc592edec31ef6ba7fe1
-
SHA1
48449253771f5c27ab8ecf831e8cb77e94cca90b
-
SHA256
ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc
-
SHA512
8694ed1dc954082b7db248b78436611e116b80a92f1ac31b693a7f26f1d3f50db80926299238656a4d37c912f19ff82262e06bf117dad465146ad7a52145672d
-
SSDEEP
12288:aAm99652dKVsiJ9Pu8BHTN3KxxcycdnawpVdAorkBK1zmQ7HDEKDmC/E:7oqcKmiJ88ZZsTzOlIWznHY
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral2/memory/3164-2-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-9-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-17-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-34-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-65-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-64-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-63-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-62-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-60-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-59-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-58-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-57-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-56-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-55-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-54-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-52-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-50-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-49-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-48-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-47-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-46-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-44-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-43-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-41-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-40-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-39-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-38-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-37-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-32-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-61-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-26-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-53-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-25-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-51-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-24-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-23-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-22-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-45-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-42-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-20-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-19-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-36-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-18-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-35-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-33-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-16-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-31-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-30-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-29-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-15-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-28-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-14-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-27-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-13-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-12-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-21-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-11-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-10-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-8-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-7-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 behavioral2/memory/3164-6-0x0000000002950000-0x0000000003950000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
pid Process 364 svchost.pif 3844 xkn.pif 4168 wcwlmeyP.pif -
Loads dropped DLL 1 IoCs
pid Process 364 svchost.pif -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyemlwcw = "C:\\Users\\Public\\Pyemlwcw.url" ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3164 set thread context of 4168 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 108 -
Program crash 1 IoCs
pid pid_target Process procid_target 4324 4168 WerFault.exe 108 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 760 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 760 PING.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3164 wrote to memory of 3672 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 90 PID 3164 wrote to memory of 3672 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 90 PID 3164 wrote to memory of 3672 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 90 PID 3164 wrote to memory of 4868 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 92 PID 3164 wrote to memory of 4868 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 92 PID 3164 wrote to memory of 4868 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 92 PID 4868 wrote to memory of 364 4868 cmd.exe 96 PID 4868 wrote to memory of 364 4868 cmd.exe 96 PID 364 wrote to memory of 4840 364 svchost.pif 97 PID 364 wrote to memory of 4840 364 svchost.pif 97 PID 4840 wrote to memory of 1144 4840 cmd.exe 99 PID 4840 wrote to memory of 1144 4840 cmd.exe 99 PID 4840 wrote to memory of 3844 4840 cmd.exe 100 PID 4840 wrote to memory of 3844 4840 cmd.exe 100 PID 4840 wrote to memory of 760 4840 cmd.exe 101 PID 4840 wrote to memory of 760 4840 cmd.exe 101 PID 3164 wrote to memory of 4168 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 108 PID 3164 wrote to memory of 4168 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 108 PID 3164 wrote to memory of 4168 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 108 PID 3164 wrote to memory of 4168 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 108 PID 3164 wrote to memory of 4168 3164 ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe"C:\Users\Admin\AppData\Local\Temp\ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\PyemlwcwF.cmd" "2⤵
- System Location Discovery: System Language Discovery
PID:3672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows \SysWOW64\svchost.pif"C:\Windows \SysWOW64\svchost.pif"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\NEO.cmd4⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\system32\extrac32.exeextrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.pif"5⤵PID:1144
-
-
C:\Users\Public\xkn.pifC:\\Users\\Public\\xkn.pif -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"5⤵
- Executes dropped EXE
PID:3844
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 105⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:760
-
-
-
-
-
C:\Users\Public\Libraries\wcwlmeyP.pifC:\Users\Public\Libraries\wcwlmeyP.pif2⤵
- Executes dropped EXE
PID:4168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 123⤵
- Program crash
PID:4324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4168 -ip 41681⤵PID:4608
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD57821e3de3812e791cf3b223500d73bc9
SHA15e211b634ce77e6fee83ce8a5b8c9a37c8b81e1d
SHA2563daa7f9eee129f61f7a452f7150ee21a1c4141586a37f37842b9c3bb53152a74
SHA5126eae270065401626df97b73a255578bf27b4f4dea480954843823046ad95e40cf706c1a767c8765ef3ab48ea3a18498375614317ec00a9ef29a4dd21edbc5f26
-
Filesize
27KB
MD5e24fa8fb365a89779b026772b9342af3
SHA1b90de3c9f3093ca8badfaf6c98218b744087e8f9
SHA25610d7b4ea056fc1037109fe6e6694849d145b0745faa9ae02957104a2834a14a0
SHA512a32f7a29c4c8cc831a5057b8db31f79e7dedb9172ac9705da6a8da65384ed23827c3cccdb833562cdab63addd679341707a2b46bbc8c802845cbbbbb01771d10
-
Filesize
171KB
MD522331abcc9472cc9dc6f37faf333aa2c
SHA12a001c30ba79a19ceaf6a09c3567c70311760aa4
SHA256bdfa725ec2a2c8ea5861d9b4c2f608e631a183fca7916c1e07a28b656cc8ec0c
SHA512c7f5baad732424b975a426867d3d8b5424aa830aa172ed0ff0ef630070bf2b4213750e123a36d8c5a741e22d3999ca1d7e77c62d4b77d6295b20a38114b7843c
-
Filesize
11KB
MD5f82aeb3b12f33250e404df6ec873dd1d
SHA1bcf538f64457e8d19da89229479cafa9c4cce12f
SHA25623b7417b47c7efb96fb7ce395e325dc831ab2ee03eadda59058d31bdbe9c1ea6
SHA5126f9d6daeed78f45f0f83310b95f47cc0a96d1db1d7f6c2e2485d7a8ecb04fee9865eec3599fee2d67f3332f68a70059f1a6a40050b93ef44d55632c24d108977
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
116KB
MD5a88976a70aed45f610a032e438a82a95
SHA1ec20b0f0d6ccc848c8ffa857ab4e771672dfa4f2
SHA256f3d5a6ebcd8cab3cc9a98488b23c2de740c6ef04e33ed317a3e2a047d53d169b
SHA512ec77bb81b9e6de4af8a17eb26281d10fc9a05947d588f2ee3680ada67ed28118fbc9a2d0e63bf0ecc2a4c318555a4f27e72ecf1a530a506e9b4fbf5efdb4f676
-
Filesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7