Analysis

  • max time kernel
    98s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2025, 01:30

General

  • Target

    ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe

  • Size

    834KB

  • MD5

    f05fa97176c0cc592edec31ef6ba7fe1

  • SHA1

    48449253771f5c27ab8ecf831e8cb77e94cca90b

  • SHA256

    ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc

  • SHA512

    8694ed1dc954082b7db248b78436611e116b80a92f1ac31b693a7f26f1d3f50db80926299238656a4d37c912f19ff82262e06bf117dad465146ad7a52145672d

  • SSDEEP

    12288:aAm99652dKVsiJ9Pu8BHTN3KxxcycdnawpVdAorkBK1zmQ7HDEKDmC/E:7oqcKmiJ88ZZsTzOlIWznHY

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 61 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe
    "C:\Users\Admin\AppData\Local\Temp\ebe09acfdf68ad7dc105449fa02e18831af08cb9646383b6f551633062f70dbc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\PyemlwcwF.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3672
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Windows \SysWOW64\svchost.pif
        "C:\Windows \SysWOW64\svchost.pif"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:364
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\NEO.cmd
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4840
          • C:\Windows\system32\extrac32.exe
            extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.pif"
            5⤵
              PID:1144
            • C:\Users\Public\xkn.pif
              C:\\Users\\Public\\xkn.pif -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
              5⤵
              • Executes dropped EXE
              PID:3844
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 10
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:760
      • C:\Users\Public\Libraries\wcwlmeyP.pif
        C:\Users\Public\Libraries\wcwlmeyP.pif
        2⤵
        • Executes dropped EXE
        PID:4168
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 12
          3⤵
          • Program crash
          PID:4324
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4168 -ip 4168
      1⤵
        PID:4608

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Public\Libraries\FX.cmd

        Filesize

        8KB

        MD5

        7821e3de3812e791cf3b223500d73bc9

        SHA1

        5e211b634ce77e6fee83ce8a5b8c9a37c8b81e1d

        SHA256

        3daa7f9eee129f61f7a452f7150ee21a1c4141586a37f37842b9c3bb53152a74

        SHA512

        6eae270065401626df97b73a255578bf27b4f4dea480954843823046ad95e40cf706c1a767c8765ef3ab48ea3a18498375614317ec00a9ef29a4dd21edbc5f26

      • C:\Users\Public\Libraries\NEO.cmd

        Filesize

        27KB

        MD5

        e24fa8fb365a89779b026772b9342af3

        SHA1

        b90de3c9f3093ca8badfaf6c98218b744087e8f9

        SHA256

        10d7b4ea056fc1037109fe6e6694849d145b0745faa9ae02957104a2834a14a0

        SHA512

        a32f7a29c4c8cc831a5057b8db31f79e7dedb9172ac9705da6a8da65384ed23827c3cccdb833562cdab63addd679341707a2b46bbc8c802845cbbbbb01771d10

      • C:\Users\Public\Libraries\wcwlmeyP.pif

        Filesize

        171KB

        MD5

        22331abcc9472cc9dc6f37faf333aa2c

        SHA1

        2a001c30ba79a19ceaf6a09c3567c70311760aa4

        SHA256

        bdfa725ec2a2c8ea5861d9b4c2f608e631a183fca7916c1e07a28b656cc8ec0c

        SHA512

        c7f5baad732424b975a426867d3d8b5424aa830aa172ed0ff0ef630070bf2b4213750e123a36d8c5a741e22d3999ca1d7e77c62d4b77d6295b20a38114b7843c

      • C:\Users\Public\PyemlwcwF.cmd

        Filesize

        11KB

        MD5

        f82aeb3b12f33250e404df6ec873dd1d

        SHA1

        bcf538f64457e8d19da89229479cafa9c4cce12f

        SHA256

        23b7417b47c7efb96fb7ce395e325dc831ab2ee03eadda59058d31bdbe9c1ea6

        SHA512

        6f9d6daeed78f45f0f83310b95f47cc0a96d1db1d7f6c2e2485d7a8ecb04fee9865eec3599fee2d67f3332f68a70059f1a6a40050b93ef44d55632c24d108977

      • C:\Users\Public\xkn.pif

        Filesize

        442KB

        MD5

        04029e121a0cfa5991749937dd22a1d9

        SHA1

        f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

        SHA256

        9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

        SHA512

        6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

      • C:\Windows \SysWOW64\NETUTILS.dll

        Filesize

        116KB

        MD5

        a88976a70aed45f610a032e438a82a95

        SHA1

        ec20b0f0d6ccc848c8ffa857ab4e771672dfa4f2

        SHA256

        f3d5a6ebcd8cab3cc9a98488b23c2de740c6ef04e33ed317a3e2a047d53d169b

        SHA512

        ec77bb81b9e6de4af8a17eb26281d10fc9a05947d588f2ee3680ada67ed28118fbc9a2d0e63bf0ecc2a4c318555a4f27e72ecf1a530a506e9b4fbf5efdb4f676

      • C:\Windows \SysWOW64\svchost.pif

        Filesize

        94KB

        MD5

        869640d0a3f838694ab4dfea9e2f544d

        SHA1

        bdc42b280446ba53624ff23f314aadb861566832

        SHA256

        0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

        SHA512

        6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

      • memory/3164-37-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-53-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-9-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-17-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-34-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-65-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-64-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-63-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-62-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-60-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-59-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-58-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-57-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-56-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-55-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-54-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-52-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-50-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-49-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-48-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-47-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-46-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-44-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-93-0x0000000000B20000-0x0000000000B21000-memory.dmp

        Filesize

        4KB

      • memory/3164-43-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-41-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-40-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-39-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-38-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-2-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-32-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-61-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-4-0x0000000000400000-0x00000000004D9000-memory.dmp

        Filesize

        868KB

      • memory/3164-25-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-26-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-51-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-24-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-23-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-22-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-45-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-42-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-20-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-19-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-36-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-18-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-35-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-33-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-16-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-31-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-30-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-29-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-15-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-28-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-14-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-27-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-13-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-12-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-21-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-1-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-0-0x0000000000B20000-0x0000000000B21000-memory.dmp

        Filesize

        4KB

      • memory/3164-11-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-10-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-8-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-7-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB

      • memory/3164-6-0x0000000002950000-0x0000000003950000-memory.dmp

        Filesize

        16.0MB