Analysis

  • max time kernel
    1s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2025, 04:46

General

  • Target

    06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe

  • Size

    112KB

  • MD5

    045a6f44159b9387c82e5a9c97884b00

  • SHA1

    3ee35fbfbe71368b145def491cd26b77724bd592

  • SHA256

    06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2

  • SHA512

    1bc0fca5554eeca0994fdc27911648193376dcd4dea2996e64777b4415d63112ff3c35b583e1b9daf002a95e0aa9fd1979ae69e05487297355b87a4badaa9b53

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ5:tVIr7zI+fAceoGxSKKo55

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
    "C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2816
    • C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
      "C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2664
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PPBJA.bat" "
        3⤵
          PID:2516
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
            4⤵
              PID:2076
          • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
            3⤵
              PID:2852
              • C:\Windows\SysWOW64\svchost.exe
                "C:\Windows\system32\svchost.exe"
                4⤵
                  PID:1976
                • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
                  4⤵
                    PID:3040
                  • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
                    4⤵
                      PID:1724

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\PPBJA.bat

                Filesize

                148B

                MD5

                3a4614705555abb049c3298e61170b7f

                SHA1

                c8686410756f346d9551256a5b878b04770950ba

                SHA256

                cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

                SHA512

                65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

              • \Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

                Filesize

                112KB

                MD5

                a882fc7efd47881fc1939ae6bc2564b5

                SHA1

                669d54d36379e30419744d79a2e9e2b80a8f4111

                SHA256

                50da66a2c4addf5272b0e90ef9c28d7ff1fb7888165ffae6a8db17205bef96ec

                SHA512

                feeee8f36d9998b1c3f57ec0aedb5209e616680ff4a132aa9cc2fcb84845a36786036ec712d0303e29dc353c1fa3e0bcfc357865729171b56fad5553a26c9734

              • memory/1724-283-0x0000000000400000-0x0000000000414000-memory.dmp

                Filesize

                80KB

              • memory/1724-293-0x0000000000400000-0x0000000000414000-memory.dmp

                Filesize

                80KB

              • memory/2320-89-0x0000000001EE0000-0x0000000001EE2000-memory.dmp

                Filesize

                8KB

              • memory/2320-14-0x0000000000270000-0x0000000000271000-memory.dmp

                Filesize

                4KB

              • memory/2320-32-0x00000000003D0000-0x00000000003D1000-memory.dmp

                Filesize

                4KB

              • memory/2320-38-0x00000000003F0000-0x00000000003F2000-memory.dmp

                Filesize

                8KB

              • memory/2320-51-0x0000000000500000-0x0000000000502000-memory.dmp

                Filesize

                8KB

              • memory/2320-50-0x00000000003F0000-0x00000000003F2000-memory.dmp

                Filesize

                8KB

              • memory/2320-20-0x00000000002A0000-0x00000000002A1000-memory.dmp

                Filesize

                4KB

              • memory/2320-88-0x0000000001EB0000-0x0000000001EB2000-memory.dmp

                Filesize

                8KB

              • memory/2320-80-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

                Filesize

                4KB

              • memory/2320-28-0x00000000003B0000-0x00000000003B1000-memory.dmp

                Filesize

                4KB

              • memory/2320-4-0x0000000000230000-0x0000000000231000-memory.dmp

                Filesize

                4KB

              • memory/2320-2-0x0000000000230000-0x0000000000231000-memory.dmp

                Filesize

                4KB

              • memory/2320-8-0x0000000000250000-0x0000000000251000-memory.dmp

                Filesize

                4KB

              • memory/2320-115-0x0000000002970000-0x0000000002972000-memory.dmp

                Filesize

                8KB

              • memory/2664-119-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2664-286-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2664-124-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2816-96-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2816-92-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2816-129-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2816-94-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2816-98-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2816-100-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

              • memory/2816-102-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2816-289-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2816-90-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/3040-290-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB