Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 11:37
Static task
static1
Behavioral task
behavioral1
Sample
REQUIRED-ORDER-SETAILS.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
REQUIRED-ORDER-SETAILS.exe
Resource
win10v2004-20241007-en
General
-
Target
REQUIRED-ORDER-SETAILS.exe
-
Size
973KB
-
MD5
c67c61c88599a7c48fce6f41d2f824af
-
SHA1
774d18c58980225ed4321ad479b0e7a45ab84efa
-
SHA256
b307218533a96ecefbdab4fad0dec64baec07ef261e7985b899a4c43b1325892
-
SHA512
3f155a898a5222339acc7ea69abe6d21f87647473f98a0ee88f12a6a41ee9fd615f3163a46d6518c31d5c8360586acf4c08798a2faa0e924bb7062a587fe14c8
-
SSDEEP
24576:bBVRVxmQEkZkjSnbyewh+lMewKe9X7yxw7IYNoIjSst8H2se:bBmB+Q+SJwxw7IYNbjSi8H2se
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral1/memory/3052-2-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-20-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-8-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-19-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-56-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-53-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-52-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-50-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-49-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-46-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-45-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-43-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-42-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-40-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-39-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-37-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-35-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-34-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-32-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-31-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-27-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-26-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-24-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-23-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-17-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-16-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-15-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-13-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-55-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-47-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-12-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-11-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-29-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-9-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-21-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-86-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-83-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-80-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-76-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-7-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-73-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-70-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-14-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-66-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-63-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-59-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-57-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-54-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-51-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-48-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-44-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-41-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-38-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-36-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-33-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-30-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-28-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-25-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-22-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-18-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 behavioral1/memory/3052-10-0x0000000003240000-0x0000000004240000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 2716 svchost.pif 2880 svchost.pif -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mrtitfkx = "C:\\Users\\Public\\Mrtitfkx.url" REQUIRED-ORDER-SETAILS.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 drive.google.com 4 drive.google.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1636 3052 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REQUIRED-ORDER-SETAILS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1280 3052 REQUIRED-ORDER-SETAILS.exe 31 PID 3052 wrote to memory of 1280 3052 REQUIRED-ORDER-SETAILS.exe 31 PID 3052 wrote to memory of 1280 3052 REQUIRED-ORDER-SETAILS.exe 31 PID 3052 wrote to memory of 1280 3052 REQUIRED-ORDER-SETAILS.exe 31 PID 3052 wrote to memory of 1844 3052 REQUIRED-ORDER-SETAILS.exe 33 PID 3052 wrote to memory of 1844 3052 REQUIRED-ORDER-SETAILS.exe 33 PID 3052 wrote to memory of 1844 3052 REQUIRED-ORDER-SETAILS.exe 33 PID 3052 wrote to memory of 1844 3052 REQUIRED-ORDER-SETAILS.exe 33 PID 3052 wrote to memory of 2088 3052 REQUIRED-ORDER-SETAILS.exe 37 PID 3052 wrote to memory of 2088 3052 REQUIRED-ORDER-SETAILS.exe 37 PID 3052 wrote to memory of 2088 3052 REQUIRED-ORDER-SETAILS.exe 37 PID 3052 wrote to memory of 2088 3052 REQUIRED-ORDER-SETAILS.exe 37 PID 3052 wrote to memory of 1636 3052 REQUIRED-ORDER-SETAILS.exe 38 PID 3052 wrote to memory of 1636 3052 REQUIRED-ORDER-SETAILS.exe 38 PID 3052 wrote to memory of 1636 3052 REQUIRED-ORDER-SETAILS.exe 38 PID 3052 wrote to memory of 1636 3052 REQUIRED-ORDER-SETAILS.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\REQUIRED-ORDER-SETAILS.exe"C:\Users\Admin\AppData\Local\Temp\REQUIRED-ORDER-SETAILS.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\MrtitfkxF.cmd" "2⤵
- System Location Discovery: System Language Discovery
PID:1280
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Libraries\FX.cmd2⤵
- System Location Discovery: System Language Discovery
PID:1844 -
C:\Windows \SysWOW64\svchost.pif"C:\Windows \SysWOW64\svchost.pif"3⤵
- Executes dropped EXE
PID:2716
-
-
C:\Windows \SysWOW64\svchost.pif"C:\Windows \SysWOW64\svchost.pif"3⤵
- Executes dropped EXE
PID:2880
-
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe2⤵PID:2088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 12242⤵
- Program crash
PID:1636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD57821e3de3812e791cf3b223500d73bc9
SHA15e211b634ce77e6fee83ce8a5b8c9a37c8b81e1d
SHA2563daa7f9eee129f61f7a452f7150ee21a1c4141586a37f37842b9c3bb53152a74
SHA5126eae270065401626df97b73a255578bf27b4f4dea480954843823046ad95e40cf706c1a767c8765ef3ab48ea3a18498375614317ec00a9ef29a4dd21edbc5f26
-
Filesize
11KB
MD5f82aeb3b12f33250e404df6ec873dd1d
SHA1bcf538f64457e8d19da89229479cafa9c4cce12f
SHA25623b7417b47c7efb96fb7ce395e325dc831ab2ee03eadda59058d31bdbe9c1ea6
SHA5126f9d6daeed78f45f0f83310b95f47cc0a96d1db1d7f6c2e2485d7a8ecb04fee9865eec3599fee2d67f3332f68a70059f1a6a40050b93ef44d55632c24d108977
-
Filesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7