Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2025, 15:48

General

  • Target

    REQUIRED-ORDER-SETAILS.exe

  • Size

    973KB

  • MD5

    c67c61c88599a7c48fce6f41d2f824af

  • SHA1

    774d18c58980225ed4321ad479b0e7a45ab84efa

  • SHA256

    b307218533a96ecefbdab4fad0dec64baec07ef261e7985b899a4c43b1325892

  • SHA512

    3f155a898a5222339acc7ea69abe6d21f87647473f98a0ee88f12a6a41ee9fd615f3163a46d6518c31d5c8360586acf4c08798a2faa0e924bb7062a587fe14c8

  • SSDEEP

    24576:bBVRVxmQEkZkjSnbyewh+lMewKe9X7yxw7IYNoIjSst8H2se:bBmB+Q+SJwxw7IYNbjSi8H2se

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 61 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\REQUIRED-ORDER-SETAILS.exe
    "C:\Users\Admin\AppData\Local\Temp\REQUIRED-ORDER-SETAILS.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Public\MrtitfkxF.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2620
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Public\Libraries\FX.cmd
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1480
      • C:\Windows \SysWOW64\svchost.pif
        "C:\Windows \SysWOW64\svchost.pif"
        3⤵
        • Executes dropped EXE
        PID:576
      • C:\Windows \SysWOW64\svchost.pif
        "C:\Windows \SysWOW64\svchost.pif"
        3⤵
        • Executes dropped EXE
        PID:280
    • C:\Windows\SysWOW64\SndVol.exe
      C:\Windows\System32\SndVol.exe
      2⤵
        PID:2952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 1220
        2⤵
        • Program crash
        PID:1044

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\Libraries\FX.cmd

      Filesize

      8KB

      MD5

      7821e3de3812e791cf3b223500d73bc9

      SHA1

      5e211b634ce77e6fee83ce8a5b8c9a37c8b81e1d

      SHA256

      3daa7f9eee129f61f7a452f7150ee21a1c4141586a37f37842b9c3bb53152a74

      SHA512

      6eae270065401626df97b73a255578bf27b4f4dea480954843823046ad95e40cf706c1a767c8765ef3ab48ea3a18498375614317ec00a9ef29a4dd21edbc5f26

    • C:\Users\Public\MrtitfkxF.cmd

      Filesize

      11KB

      MD5

      f82aeb3b12f33250e404df6ec873dd1d

      SHA1

      bcf538f64457e8d19da89229479cafa9c4cce12f

      SHA256

      23b7417b47c7efb96fb7ce395e325dc831ab2ee03eadda59058d31bdbe9c1ea6

      SHA512

      6f9d6daeed78f45f0f83310b95f47cc0a96d1db1d7f6c2e2485d7a8ecb04fee9865eec3599fee2d67f3332f68a70059f1a6a40050b93ef44d55632c24d108977

    • C:\Windows \SysWOW64\svchost.pif

      Filesize

      94KB

      MD5

      869640d0a3f838694ab4dfea9e2f544d

      SHA1

      bdc42b280446ba53624ff23f314aadb861566832

      SHA256

      0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

      SHA512

      6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

    • memory/2248-0-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/2248-2-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-1-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-4-0x0000000000400000-0x00000000004FC000-memory.dmp

      Filesize

      1008KB

    • memory/2248-6-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-7-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-8-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-9-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-10-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-13-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-15-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-12-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-18-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-20-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-21-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-22-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-27-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-24-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-29-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-31-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-34-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-37-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-39-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-41-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-43-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-46-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-48-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-49-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-50-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-36-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-55-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-53-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-60-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-58-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-62-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-65-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-67-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-69-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-74-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-72-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-75-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-77-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-79-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-82-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-84-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-25-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-47-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-45-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-44-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-42-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-40-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-38-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-35-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-33-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-32-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-30-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-28-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-26-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-23-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-19-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-17-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-16-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-14-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB

    • memory/2248-11-0x0000000003270000-0x0000000004270000-memory.dmp

      Filesize

      16.0MB