Analysis
-
max time kernel
3s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
Resource
win10v2004-20241007-en
General
-
Target
06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe
-
Size
112KB
-
MD5
045a6f44159b9387c82e5a9c97884b00
-
SHA1
3ee35fbfbe71368b145def491cd26b77724bd592
-
SHA256
06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2
-
SHA512
1bc0fca5554eeca0994fdc27911648193376dcd4dea2996e64777b4415d63112ff3c35b583e1b9daf002a95e0aa9fd1979ae69e05487297355b87a4badaa9b53
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ5:tVIr7zI+fAceoGxSKKo55
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral2/memory/3628-67-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3628-66-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3628-68-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3628-78-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe -
Executes dropped EXE 2 IoCs
pid Process 1604 WAMain.exe 4016 WAMain.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4300 set thread context of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 set thread context of 3820 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 84 PID 1604 set thread context of 3956 1604 WAMain.exe 90 PID 1604 set thread context of 4016 1604 WAMain.exe 91 -
resource yara_rule behavioral2/memory/3820-17-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3820-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3820-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3820-48-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3628-67-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3628-66-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3628-68-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3628-65-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3628-63-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3820-72-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4016-75-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3628-78-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe 4572 svchost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 4572 svchost.exe 3820 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 1604 WAMain.exe 3956 svchost.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 4300 wrote to memory of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 wrote to memory of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 wrote to memory of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 wrote to memory of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 wrote to memory of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 wrote to memory of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 wrote to memory of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 wrote to memory of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 wrote to memory of 4572 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 83 PID 4300 wrote to memory of 3820 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 84 PID 4300 wrote to memory of 3820 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 84 PID 4300 wrote to memory of 3820 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 84 PID 4300 wrote to memory of 3820 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 84 PID 4300 wrote to memory of 3820 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 84 PID 4300 wrote to memory of 3820 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 84 PID 4300 wrote to memory of 3820 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 84 PID 4300 wrote to memory of 3820 4300 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 84 PID 3820 wrote to memory of 1172 3820 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 85 PID 3820 wrote to memory of 1172 3820 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 85 PID 3820 wrote to memory of 1172 3820 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 85 PID 1172 wrote to memory of 1152 1172 cmd.exe 88 PID 1172 wrote to memory of 1152 1172 cmd.exe 88 PID 1172 wrote to memory of 1152 1172 cmd.exe 88 PID 3820 wrote to memory of 1604 3820 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 89 PID 3820 wrote to memory of 1604 3820 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 89 PID 3820 wrote to memory of 1604 3820 06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe 89 PID 1604 wrote to memory of 3956 1604 WAMain.exe 90 PID 1604 wrote to memory of 3956 1604 WAMain.exe 90 PID 1604 wrote to memory of 3956 1604 WAMain.exe 90 PID 1604 wrote to memory of 3956 1604 WAMain.exe 90 PID 1604 wrote to memory of 3956 1604 WAMain.exe 90 PID 1604 wrote to memory of 3956 1604 WAMain.exe 90 PID 1604 wrote to memory of 3956 1604 WAMain.exe 90 PID 1604 wrote to memory of 3956 1604 WAMain.exe 90 PID 1604 wrote to memory of 3956 1604 WAMain.exe 90 PID 1604 wrote to memory of 4016 1604 WAMain.exe 91 PID 1604 wrote to memory of 4016 1604 WAMain.exe 91 PID 1604 wrote to memory of 4016 1604 WAMain.exe 91 PID 1604 wrote to memory of 4016 1604 WAMain.exe 91 PID 1604 wrote to memory of 4016 1604 WAMain.exe 91 PID 1604 wrote to memory of 4016 1604 WAMain.exe 91 PID 1604 wrote to memory of 4016 1604 WAMain.exe 91 PID 1604 wrote to memory of 4016 1604 WAMain.exe 91 PID 1604 wrote to memory of 3628 1604 WAMain.exe 92 PID 1604 wrote to memory of 3628 1604 WAMain.exe 92 PID 1604 wrote to memory of 3628 1604 WAMain.exe 92 PID 1604 wrote to memory of 3628 1604 WAMain.exe 92 PID 1604 wrote to memory of 3628 1604 WAMain.exe 92 PID 1604 wrote to memory of 3628 1604 WAMain.exe 92 PID 1604 wrote to memory of 3628 1604 WAMain.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4572
-
-
C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"C:\Users\Admin\AppData\Local\Temp\06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YUVIN.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1152
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3956
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4016
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵PID:3628
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD5285a33eeeaf3ae8e32ae309c90e1413f
SHA1cfc8376e583259ed02ca7707376677923eab431b
SHA2564808886de05b3c3358dcf93b742714218996be7ad8a199f2e7966bf32b242aac
SHA5126ca6f94775ca5b5a8088e3b0c9a82f049c88861a8897b6e730b612faecc064e5204fe24b90e95bc3552e57a0fc4fe9a87dcbae10850a5b66e2a8b37b139cf9a0