Analysis

  • max time kernel
    3s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2025, 04:46

General

  • Target

    06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe

  • Size

    112KB

  • MD5

    045a6f44159b9387c82e5a9c97884b00

  • SHA1

    3ee35fbfbe71368b145def491cd26b77724bd592

  • SHA256

    06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2

  • SHA512

    1bc0fca5554eeca0994fdc27911648193376dcd4dea2996e64777b4415d63112ff3c35b583e1b9daf002a95e0aa9fd1979ae69e05487297355b87a4badaa9b53

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ5:tVIr7zI+fAceoGxSKKo55

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
    "C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4572
    • C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
      "C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3820
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YUVIN.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:1152
      • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3956
        • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4016
        • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
          4⤵
            PID:3628

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\YUVIN.txt

      Filesize

      148B

      MD5

      3a4614705555abb049c3298e61170b7f

      SHA1

      c8686410756f346d9551256a5b878b04770950ba

      SHA256

      cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

      SHA512

      65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

    • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

      Filesize

      112KB

      MD5

      285a33eeeaf3ae8e32ae309c90e1413f

      SHA1

      cfc8376e583259ed02ca7707376677923eab431b

      SHA256

      4808886de05b3c3358dcf93b742714218996be7ad8a199f2e7966bf32b242aac

      SHA512

      6ca6f94775ca5b5a8088e3b0c9a82f049c88861a8897b6e730b612faecc064e5204fe24b90e95bc3552e57a0fc4fe9a87dcbae10850a5b66e2a8b37b139cf9a0

    • memory/1604-71-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1604-50-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1604-47-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1604-46-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1604-45-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3628-68-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3628-63-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3628-78-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3628-67-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3628-66-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3628-65-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3820-8-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3820-12-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3820-17-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3820-72-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3820-48-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3956-74-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/3956-53-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/3956-51-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/3956-57-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4016-75-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/4300-7-0x0000000002AD0000-0x0000000002AD2000-memory.dmp

      Filesize

      8KB

    • memory/4300-3-0x0000000002190000-0x0000000002192000-memory.dmp

      Filesize

      8KB

    • memory/4300-4-0x00000000021C0000-0x00000000021C2000-memory.dmp

      Filesize

      8KB

    • memory/4300-5-0x0000000002210000-0x0000000002212000-memory.dmp

      Filesize

      8KB

    • memory/4300-2-0x0000000002180000-0x0000000002182000-memory.dmp

      Filesize

      8KB

    • memory/4300-16-0x0000000002180000-0x0000000002182000-memory.dmp

      Filesize

      8KB

    • memory/4572-49-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4572-6-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4572-18-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4572-10-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB