Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 17:00
Behavioral task
behavioral1
Sample
e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe
Resource
win10v2004-20241007-en
General
-
Target
e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe
-
Size
130KB
-
MD5
a0cb0bf7fb60c093e44f019653d7d550
-
SHA1
513d361eff25d3136d8b44bd859b6a4107bf0a27
-
SHA256
e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1
-
SHA512
d2f20f13655ef6e08c8a4d251f106f118b727a745aa5796e43515da20ffcb7a7d71b96ccf188406d7e60f76edea71f75f1f0a91ab594e942f080cfe4af02dd98
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZy:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKk
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 6 IoCs
resource yara_rule behavioral2/memory/5064-54-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/5064-50-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/5064-56-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/5064-58-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/5064-59-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/5064-67-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe -
Executes dropped EXE 3 IoCs
pid Process 2964 Flaseher.exe 1852 Flaseher.exe 5064 Flaseher.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2144 set thread context of 4948 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 84 PID 2964 set thread context of 1852 2964 Flaseher.exe 95 PID 2964 set thread context of 5064 2964 Flaseher.exe 96 -
resource yara_rule behavioral2/memory/2144-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2144-6-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4948-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4948-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2144-14-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4948-15-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4948-16-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000a000000023b82-32.dat upx behavioral2/memory/2964-39-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4948-44-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2964-43-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2964-45-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2964-46-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2964-47-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2964-62-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4948-63-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1852-65-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flaseher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flaseher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flaseher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe Token: SeDebugPrivilege 1852 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 4948 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 2964 Flaseher.exe 1852 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2144 wrote to memory of 4948 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 84 PID 2144 wrote to memory of 4948 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 84 PID 2144 wrote to memory of 4948 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 84 PID 2144 wrote to memory of 4948 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 84 PID 2144 wrote to memory of 4948 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 84 PID 2144 wrote to memory of 4948 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 84 PID 2144 wrote to memory of 4948 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 84 PID 2144 wrote to memory of 4948 2144 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 84 PID 4948 wrote to memory of 4160 4948 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 87 PID 4948 wrote to memory of 4160 4948 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 87 PID 4948 wrote to memory of 4160 4948 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 87 PID 4160 wrote to memory of 1184 4160 cmd.exe 90 PID 4160 wrote to memory of 1184 4160 cmd.exe 90 PID 4160 wrote to memory of 1184 4160 cmd.exe 90 PID 4948 wrote to memory of 2964 4948 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 91 PID 4948 wrote to memory of 2964 4948 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 91 PID 4948 wrote to memory of 2964 4948 e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe 91 PID 2964 wrote to memory of 1852 2964 Flaseher.exe 95 PID 2964 wrote to memory of 1852 2964 Flaseher.exe 95 PID 2964 wrote to memory of 1852 2964 Flaseher.exe 95 PID 2964 wrote to memory of 1852 2964 Flaseher.exe 95 PID 2964 wrote to memory of 1852 2964 Flaseher.exe 95 PID 2964 wrote to memory of 1852 2964 Flaseher.exe 95 PID 2964 wrote to memory of 1852 2964 Flaseher.exe 95 PID 2964 wrote to memory of 1852 2964 Flaseher.exe 95 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96 PID 2964 wrote to memory of 5064 2964 Flaseher.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe"C:\Users\Admin\AppData\Local\Temp\e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe"C:\Users\Admin\AppData\Local\Temp\e401eef8c37a2118d1f6e0ee54c279d8b59e558cfffeb4edb31a6a30adc8a7d1N.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RPNSF.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1184
-
-
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1852
-
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5064
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
Filesize
130KB
MD5ca6a73a398b5c39615370bb2c9d9f21c
SHA1bfe83f5e0ce5dbaf99f73408020dd42b36ae2920
SHA256b380e2e3c112eeb1eea8846f943bcfd4b108520e020ceaee4c963f729393cdd7
SHA512b04ff45218d58f4f7f27d17d2b59c18444bae4d67e1e746e814b140ae9b6aef88276bcce5671c2e0d04e621c083e26f105e7bc2e35e99ce18bf0228b32a2a3d0