Analysis
-
max time kernel
102s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
31/03/2025, 15:03
General
-
Target
OEC-GCE-250326-Shipper Verified Gross Mass (VGM) Declaration Form (update) SO 1047.XLSX.scr
-
Size
1.7MB
-
MD5
2c2b7e9ce7165ee6107af23a344e0b83
-
SHA1
243e4e9f14fe62eddd486127fa2a3e468abb7e36
-
SHA256
7e40808321b27f4f1efe0972adc667ff4bd65c1ea4291dfae2925d3e222351e3
-
SHA512
11128e395f8791ebe714bb20755bd7bf9ad257aba9a42612bb61760b2a26591d5483d2641b4afae50f0dd87231e28ff6ab96d2c9fbd61e3b6ee372be1f768391
-
SSDEEP
24576:7gvMTgfHxu3/ICpRODsFe6B8mx438dDswEhMbHqJ1nBquARUKHWAT4roS8AXmn:7gnxg/y3wlEfJ1BqgK2ATmonAE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OEC-GCE-250326-Shipper Verified Gross Mass (VGM) Declaration Form (update) SO 1047.XLSX.scr"C:\Users\Admin\AppData\Local\Temp\OEC-GCE-250326-Shipper Verified Gross Mass (VGM) Declaration Form (update) SO 1047.XLSX.scr" /S1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\957.cmd""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o3⤵
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\23830.cmd""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\ProgramData\WSP\wsp.exe"C:\ProgramData\WSP\wsp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 13163⤵
- Program crash
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\\Users\\Admin\\Links\Fqukkjoy.url1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Links\Fqukkjoy.PIF"C:\Users\Admin\Links\Fqukkjoy.PIF"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 12203⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2444 -ip 24441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1556 -ip 15561⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD52c2b7e9ce7165ee6107af23a344e0b83
SHA1243e4e9f14fe62eddd486127fa2a3e468abb7e36
SHA2567e40808321b27f4f1efe0972adc667ff4bd65c1ea4291dfae2925d3e222351e3
SHA51211128e395f8791ebe714bb20755bd7bf9ad257aba9a42612bb61760b2a26591d5483d2641b4afae50f0dd87231e28ff6ab96d2c9fbd61e3b6ee372be1f768391
-
Filesize
99B
MD589a2270c94ea22b17716fa632640c1d5
SHA18eb10f58af1ad70729962a41d661be74941b3165
SHA2562236cc6ab134b232d1e71b3901f1907d9a040a41f10284112bd58fd57efda071
SHA512ddeb3db120d2a1cb1e1e033599dccb19a6cdf52c42a8997af029caf4347c9d2d656772e94f4127888e551358aad9f5e3c4ba0d3a6290bc9f0e2a096fab51da78
-
Filesize
2KB
MD59a020804eba1ffac2928d7c795144bbf
SHA161fdc4135afdc99e106912aeafeac9c8a967becc
SHA256a86c6c7a2bf9e12c45275a5e7ebebd5e6d2ba302fe0a12600b7c9fdf283d9e63
SHA51242f6d754f1bdbeb6e4cc7aeb57ff4c4d126944f950d260a0839911e576ad16002c16122f81c1d39fa529432dca0a48c9acfbb18804ca9044425c8e424a5518be
-
Filesize
19KB
MD51df650cca01129127d30063634ab5c03
SHA1bc7172dec0b12b05f2247bd5e17751eb33474d4e
SHA256edd4094e7a82a6ff8be65d6b075e9513bd15a6b74f8032b5c10ce18f7191fa60
SHA5120bddf9ecaaedb0c30103a1fbfb644d6d4f7608bd596403307ed89b2390568c3a29e2cf55d10e2eadbfc407ede52eaf9a4f2321ba5f37e358a1039f73c7688fbd
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB