modiloader | bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709d

Analysis

max time kernel
106s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 00:27 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe
Size

112KB
MD5

fe309f7eef1a5f07f19296e21d9d50d0
SHA1

d6512e42f91d0381391eaab9813425aa00b09e4d
SHA256

bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709d
SHA512

d48d33ab6c7d08f279aadfe89f9e3674fbcfe7703471b4ce9f188ef9ed88db6a29fc38d82ae26376fbd499964968421dd3c7d546b22750c03153ec5b27d87948
SSDEEP

1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJx:tVIr7zI+fAceoGxSKKo5x

Score

10^/10

modiloader discovery persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral2/memory/3184-65-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/3184-66-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/3184-64-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/3184-73-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe

Executes dropped EXE 3 IoCs

pid	Process
4740	WAMain.exe
4788	WAMain.exe
3184	WAMain.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe"	reg.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4676 set thread context of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 set thread context of 3740	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	84
PID 4740 set thread context of 2360	4740	WAMain.exe	90
PID 4740 set thread context of 4788	4740	WAMain.exe	91
PID 4740 set thread context of 3184	4740	WAMain.exe	93

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3740-9-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3740-16-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3740-20-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3184-59-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3740-50-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3184-65-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3184-66-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3184-64-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3184-63-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3740-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4788-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3184-73-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	2360	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WAMain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WAMain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WAMain.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe
4528	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe
Token: SeDebugPrivilege	4788	WAMain.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe
4528	svchost.exe
3740	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe
4740	WAMain.exe
4788	WAMain.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 wrote to memory of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 wrote to memory of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 wrote to memory of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 wrote to memory of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 wrote to memory of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 wrote to memory of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 wrote to memory of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 wrote to memory of 4528	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	83
PID 4676 wrote to memory of 3740	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	84
PID 4676 wrote to memory of 3740	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	84
PID 4676 wrote to memory of 3740	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	84
PID 4676 wrote to memory of 3740	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	84
PID 4676 wrote to memory of 3740	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	84
PID 4676 wrote to memory of 3740	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	84
PID 4676 wrote to memory of 3740	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	84
PID 4676 wrote to memory of 3740	4676	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	84
PID 3740 wrote to memory of 4316	3740	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	85
PID 3740 wrote to memory of 4316	3740	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	85
PID 3740 wrote to memory of 4316	3740	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	85
PID 4316 wrote to memory of 4180	4316	cmd.exe	88
PID 4316 wrote to memory of 4180	4316	cmd.exe	88
PID 4316 wrote to memory of 4180	4316	cmd.exe	88
PID 3740 wrote to memory of 4740	3740	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	89
PID 3740 wrote to memory of 4740	3740	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	89
PID 3740 wrote to memory of 4740	3740	bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe	89
PID 4740 wrote to memory of 2360	4740	WAMain.exe	90
PID 4740 wrote to memory of 2360	4740	WAMain.exe	90
PID 4740 wrote to memory of 2360	4740	WAMain.exe	90
PID 4740 wrote to memory of 2360	4740	WAMain.exe	90
PID 4740 wrote to memory of 4788	4740	WAMain.exe	91
PID 4740 wrote to memory of 4788	4740	WAMain.exe	91
PID 4740 wrote to memory of 4788	4740	WAMain.exe	91
PID 4740 wrote to memory of 4788	4740	WAMain.exe	91
PID 4740 wrote to memory of 4788	4740	WAMain.exe	91
PID 4740 wrote to memory of 4788	4740	WAMain.exe	91
PID 4740 wrote to memory of 4788	4740	WAMain.exe	91
PID 4740 wrote to memory of 4788	4740	WAMain.exe	91
PID 4740 wrote to memory of 3184	4740	WAMain.exe	93
PID 4740 wrote to memory of 3184	4740	WAMain.exe	93
PID 4740 wrote to memory of 3184	4740	WAMain.exe	93
PID 4740 wrote to memory of 3184	4740	WAMain.exe	93
PID 4740 wrote to memory of 3184	4740	WAMain.exe	93
PID 4740 wrote to memory of 3184	4740	WAMain.exe	93
PID 4740 wrote to memory of 3184	4740	WAMain.exe	93
PID 4740 wrote to memory of 3184	4740	WAMain.exe	93

C:\Users\Admin\AppData\Local\Temp\bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe
"C:\Users\Admin\AppData\Local\Temp\bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4528
- C:\Users\Admin\AppData\Local\Temp\bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe
  "C:\Users\Admin\AppData\Local\Temp\bba9e62ccd99eeeb0ad81146a0439b991df4b8c6478163917a02bc231889709dN.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CSTQY.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4180
- - C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:2360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 84
        5⤵
        Program crash
        
        PID:2460
  - - C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4788
  - - C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2360 -ip 2360
1⤵
PID:2104

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

209.205.72.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.205.72.20.in-addr.arpa

IN PTR

Response
DNS

106.27.33.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

106.27.33.23.in-addr.arpa

IN PTR

Response

106.27.33.23.in-addr.arpa

IN PTR

a23-33-27-106deploystaticakamaitechnologiescom
DNS

17.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

17.160.190.20.in-addr.arpa

IN PTR

Response
DNS

159.96.196.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

159.96.196.23.in-addr.arpa

IN PTR

Response

159.96.196.23.in-addr.arpa

IN PTR

a23-196-96-159deploystaticakamaitechnologiescom
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

180.129.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

180.129.81.91.in-addr.arpa

IN PTR

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

107.27.33.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

107.27.33.23.in-addr.arpa

IN PTR

Response

107.27.33.23.in-addr.arpa

IN PTR

a23-33-27-107deploystaticakamaitechnologiescom
DNS

43.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.229.111.52.in-addr.arpa

IN PTR

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response
DNS

billabong4102.no-ip.biz

WAMain.exe

Remote address:

8.8.8.8:53

Request

billabong4102.no-ip.biz

IN A

Response

No results found

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

209.205.72.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

209.205.72.20.in-addr.arpa
8.8.8.8:53

106.27.33.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

106.27.33.23.in-addr.arpa
8.8.8.8:53

17.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

17.160.190.20.in-addr.arpa
8.8.8.8:53

159.96.196.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

159.96.196.23.in-addr.arpa
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

50.23.12.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

50.23.12.20.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

180.129.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

180.129.81.91.in-addr.arpa
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

107.27.33.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

107.27.33.23.in-addr.arpa
8.8.8.8:53

43.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

43.229.111.52.in-addr.arpa
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz
8.8.8.8:53

billabong4102.no-ip.biz

dns

WAMain.exe

69 B
129 B
1
1

DNS Request

billabong4102.no-ip.biz

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CSTQY.txt

Filesize
148B

MD5
3a4614705555abb049c3298e61170b7f

SHA1
c8686410756f346d9551256a5b878b04770950ba

SHA256
cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

SHA512
65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

Filesize
112KB

MD5
7d67aa009259e4ac14be9dae3531a624

SHA1
4baba93335a59842f71ee06fcf946b9f95a281a0

SHA256
1d508ba92c6aea094df462f884680dd7a85702bef68637624fb4675b1be22a12

SHA512
b846738d051d04056c6ba707264ce16aab7189f46b3574058728269ace98c92a0dba9a1b3dbda6694b3d703d3c4f5ffab6d5d4235f9d040677218f4139dc8206

Download Submit
memory/3184-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3184-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3184-73-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3184-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3184-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3184-66-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3740-50-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3740-20-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3740-16-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3740-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3740-9-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4528-11-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4528-19-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4528-51-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4528-14-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4528-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4676-4-0x0000000002B50000-0x0000000002B52000-memory.dmp

Filesize
8KB

Download
memory/4676-5-0x0000000002C80000-0x0000000002C82000-memory.dmp

Filesize
8KB

Download
memory/4676-2-0x0000000002B10000-0x0000000002B12000-memory.dmp

Filesize
8KB

Download
memory/4676-3-0x0000000002B20000-0x0000000002B22000-memory.dmp

Filesize
8KB

Download
memory/4676-12-0x0000000002B10000-0x0000000002B12000-memory.dmp

Filesize
8KB

Download
memory/4676-21-0x0000000002B20000-0x0000000002B22000-memory.dmp

Filesize
8KB

Download
memory/4676-6-0x0000000002CB0000-0x0000000002CB2000-memory.dmp

Filesize
8KB

Download
memory/4676-8-0x0000000002D30000-0x0000000002D32000-memory.dmp

Filesize
8KB

Download
memory/4740-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4740-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4740-67-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4740-49-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4740-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4788-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.