Analysis
-
max time kernel
1s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
Resource
win10v2004-20241007-en
General
-
Target
06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
-
Size
112KB
-
MD5
045a6f44159b9387c82e5a9c97884b00
-
SHA1
3ee35fbfbe71368b145def491cd26b77724bd592
-
SHA256
06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2
-
SHA512
1bc0fca5554eeca0994fdc27911648193376dcd4dea2996e64777b4415d63112ff3c35b583e1b9daf002a95e0aa9fd1979ae69e05487297355b87a4badaa9b53
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ5:tVIr7zI+fAceoGxSKKo55
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/1724-283-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/1724-293-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2320 set thread context of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 set thread context of 2664 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 31 -
resource yara_rule behavioral1/memory/2664-119-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2664-124-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1724-283-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2664-286-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3040-290-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1724-293-0x0000000000400000-0x0000000000414000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe 2816 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 2664 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 2816 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2816 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 30 PID 2320 wrote to memory of 2664 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 31 PID 2320 wrote to memory of 2664 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 31 PID 2320 wrote to memory of 2664 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 31 PID 2320 wrote to memory of 2664 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 31 PID 2320 wrote to memory of 2664 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 31 PID 2320 wrote to memory of 2664 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 31 PID 2320 wrote to memory of 2664 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 31 PID 2320 wrote to memory of 2664 2320 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PPBJA.bat" "3⤵PID:2516
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵PID:2076
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵PID:2852
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:1976
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵PID:3040
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵PID:1724
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD5a882fc7efd47881fc1939ae6bc2564b5
SHA1669d54d36379e30419744d79a2e9e2b80a8f4111
SHA25650da66a2c4addf5272b0e90ef9c28d7ff1fb7888165ffae6a8db17205bef96ec
SHA512feeee8f36d9998b1c3f57ec0aedb5209e616680ff4a132aa9cc2fcb84845a36786036ec712d0303e29dc353c1fa3e0bcfc357865729171b56fad5553a26c9734