Overview

overview

10

Static

static

10

pisun.exe

windows10-ltsc_2021-x64

Analysis

  • max time kernel
    124s
  • max time network
    136s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    21/03/2025, 20:49

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    pisun.exe

  • Size

    54KB

  • MD5

    45140e967970cd63521eaa76dc4db7d7

  • SHA1

    aae8aa4c5fb8e1d5a830f1f095d7550a89b7634a

  • SHA256

    3990ab6d73f0a92606cb4c86d39e077f014da65413a264be94d03ca8478e64b8

  • SHA512

    d8c5274fc1c66700c3fb63527973cb20106070698eebdf90e6b3f9ace371e34a653e382f949683d9aab0cb33fdd00ab2b943e499a4d2d6f42a24822fa2142129

  • SSDEEP

    768:U8I0g652Esltuq55JR2ET3NwJSNbxWQG35bmaePD5PvXOC2XXJdxIEpmvg:U8ZVGtZ5DTCGlWQcGD0LX3xIEpmvg

Score
10/10
modiloadernjratbootkitdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modiloader family
    modiloader
  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • ModiLoader Second Stage 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\pisun.exe
    "C:\Users\Admin\AppData\Local\Temp\pisun.exe"
    1⤵
    • Checks computer location settings
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Users\Admin\AppData\Local\Temp\5fda5be195fc4b58b1f5e73f3bef5d6c.exe
      "C:\Users\Admin\AppData\Local\Temp\5fda5be195fc4b58b1f5e73f3bef5d6c.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Users\Admin\AppData\Local\Temp\24f42c7a7aa449d28b33f49ca1b65d82.exe
        "C:\Users\Admin\AppData\Local\Temp\24f42c7a7aa449d28b33f49ca1b65d82.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5236
      • C:\Users\Admin\AppData\Local\Temp\6576448befc34053be36e65d415e8e6e.exe
        "C:\Users\Admin\AppData\Local\Temp\6576448befc34053be36e65d415e8e6e.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4488
    • C:\Users\Admin\AppData\Local\Temp\c25bc3a215454c08b6d316bc3b0da046.exe
      "C:\Users\Admin\AppData\Local\Temp\c25bc3a215454c08b6d316bc3b0da046.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Impair Defenses: Safe Mode Boot
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3736
    • C:\Users\Admin\AppData\Local\Temp\1e25feadfc42484e92b88ff9bc327934.exe
      "C:\Users\Admin\AppData\Local\Temp\1e25feadfc42484e92b88ff9bc327934.exe"
      2⤵
      • Executes dropped EXE
      PID:3756
    • C:\Users\Admin\AppData\Local\Temp\211d6587ee2d4d799117e95e10e05dc0.exe
      "C:\Users\Admin\AppData\Local\Temp\211d6587ee2d4d799117e95e10e05dc0.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      PID:3968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 524
        3⤵
        • Program crash
        PID:2712
    • C:\Users\Admin\AppData\Local\Temp\f7aa3b071ce244ddae6079fac73f648b.exe
      "C:\Users\Admin\AppData\Local\Temp\f7aa3b071ce244ddae6079fac73f648b.exe"
      2⤵
      • Executes dropped EXE
      PID:2044
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start shutdown /r /f /t 3
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Windows\SysWOW64\shutdown.exe
        shutdown /r /f /t 3
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4324
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:5448
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3360
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1740
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x310 0x3e8
      1⤵
        PID:5808
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3968 -ip 3968
        1⤵
          PID:2028
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x4 /state0:0xa39db855 /state1:0x41c64e6d
          1⤵
            PID:1528

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133870638714209394.txt
            Filesize

            83KB

            MD5

            59ef71bba361ebbf3e534fb449f23ce3

            SHA1

            289ec7be9479810148310417c8432d3a5676979e

            SHA256

            49f62d8abfb2f8c72b579c75c668f77f171458fbf40608aa2b33f1e76889639b

            SHA512

            8c41c53f5d6959e30b4e06cdd529230550a6d06711de3937c1edfd8e6ec3069e963770612bc88ccd3926a04f79f073554c812670305c7c3d4a53ab52615296f7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1e25feadfc42484e92b88ff9bc327934.exe
            Filesize

            10.0MB

            MD5

            be9b8e7c29977c01f3122f1e5082f45d

            SHA1

            c53a253ac33ab33e94f3ad5e5200645b6391b779

            SHA256

            cb6384b855d46fe5678bb3d5d1fc77c800884f8345cb490e1aa71646e872d3ae

            SHA512

            91514128a7a488581372881a556b081ad920086fd43da84188033f0bd48f294199192b753ec691c2cb79072420b346f767d9cfb4ef2d119ca1e345d65df8dc34

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\211d6587ee2d4d799117e95e10e05dc0.exe
            Filesize

            47KB

            MD5

            c61693e8d501dcdbcd2346853a80417a

            SHA1

            edf5803d2c9cc7807b571d9d081ca06387ee7cd9

            SHA256

            f0d5399c42971102e56abbcc9efd1d0b104ddb36da5bccd67e18850a1a21fad4

            SHA512

            8cc0fe94e144e754cf0fd0d4de2f4361adaf7fc83116fc3009272efa6df2eb0c60b04dc037ffde1581906471196ffae0cb51262a7ac731b515ff091a64da41d6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\24f42c7a7aa449d28b33f49ca1b65d82.exe
            Filesize

            28KB

            MD5

            62cbb85434223022a0b0e369b227a3d9

            SHA1

            4978b691168f16c678a1ffe53e126ba1d946bce0

            SHA256

            ea3087204e3ed644308a0a96bbf319590a9b2701ac850bb63f2ba3dc4955f1fd

            SHA512

            f76d281ce4c4401315f811dba1512757fa59a9c1ca6486c006f7861aed793a1f196fd66b772405374a751f383b5a234234e64de16f2fe9d613694e354b882f69

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\5fda5be195fc4b58b1f5e73f3bef5d6c.exe
            Filesize

            54KB

            MD5

            036b3d9a4d952a24395e7bb611c343fc

            SHA1

            c22e1bd6a08cb355af0916d071c1bca492b71948

            SHA256

            4f04da82187c751bef7418649b8581ae26258687eb437293bc1580339de7a414

            SHA512

            2a0e6508fba8adec93929db094e664b252cfa635694a7d2e72c4b7d3ba2be6d30c37e5de17559dd728fdeda27fd5f843247a197339255b1d2c178dea34c6652b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\6576448befc34053be36e65d415e8e6e.exe
            Filesize

            500KB

            MD5

            07a9f858f9867f52163d7cec3bd899e3

            SHA1

            d7feae9f88b807606b747a27ac95ede57b2615f5

            SHA256

            0fde5da043382f46f04eaa04028fba0d127c20b87b88fbd7966805d5c93307ca

            SHA512

            e07185b51ea52aa9850beaa099a621383a06d452666e96b25e2f0a9f7152fe5f4dbcc8a75a6cb336ee80c4273f85d04abdc142e7d0f87a4f2a9b85a51036cb30

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\c25bc3a215454c08b6d316bc3b0da046.exe
            Filesize

            397KB

            MD5

            2807ad9dd62546a82e0becf51478711f

            SHA1

            81825e16e7017884b2490b3be78ca0171f0e80c3

            SHA256

            2a6a7744dab101b5bccd7340ca0dd5fe02cb5f6e06529094e95ba7aa44608bfb

            SHA512

            16b8f7a5dccb75a1091ac5f405900a8dfa97e988799d011b6e027fbd4d624428b52916f496ca73ccc41e2f9cd86bf5d2741f917fae3700b852d532541d8c87ec

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\f7aa3b071ce244ddae6079fac73f648b.exe
            Filesize

            4.7MB

            MD5

            bb4a5266324a3dee6cb4b06d03f3f3e9

            SHA1

            9f08e998088faa8386928c4a4dcbca5214b4f422

            SHA256

            7dd0d8c33379f84e3e23d29340051465197735d7fc1e5debf9bf5a6b4f220484

            SHA512

            18fc7355ea1182096aac1786369e07b0828346dcb68405082089c2498fbaffce32563cb666600e6d50ea4c0810ffaa8bbbca014e4b5fd14a0c6100483885ad66

            Download Submit

          • memory/1740-91-0x00000239B5EB0000-0x00000239B5FB0000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1740-76-0x00000239A31E0000-0x00000239A3200000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1740-77-0x00000239A31C0000-0x00000239A31E0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1740-57-0x00000239A31A0000-0x00000239A31C0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1740-44-0x00000239A2100000-0x00000239A2200000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1824-19-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1824-22-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1824-23-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1824-36-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1824-20-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1824-24-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1824-21-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/2044-244-0x0000029EAD050000-0x0000029EAD508000-memory.dmp

            Filesize

            4.7MB

            Download

          • memory/3580-37-0x0000000000620000-0x0000000000621000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3580-40-0x0000000000400000-0x000000000046A000-memory.dmp

            Filesize

            424KB

            Download

          • memory/3580-38-0x0000000000400000-0x000000000046A000-memory.dmp

            Filesize

            424KB

            Download

          • memory/3736-43-0x0000000003680000-0x0000000003681000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3756-218-0x0000026E0DB20000-0x0000026E0E51C000-memory.dmp

            Filesize

            10.0MB

            Download

          • memory/3968-247-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

            Download

          • memory/4272-39-0x0000000001400000-0x0000000001410000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4272-170-0x0000000001400000-0x0000000001410000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4272-5-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/4272-4-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/4272-3-0x0000000074F42000-0x0000000074F43000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4272-6-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/4272-2-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/4272-1-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/4272-18-0x0000000074F40000-0x00000000754F1000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/4272-0-0x0000000074F42000-0x0000000074F43000-memory.dmp

            Filesize

            4KB

            Download