Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system - submitted
04/11/2025, 09:04
Static task
static1
Behavioral task
behavioral1
Sample
Sample photos and drawings.vbs
Resource
win10v2004-20251016-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target Sample photos and drawings.vbs
- Size 2.1MB
- Sample251104-k1xtdaaz5e
- SHA256 48397dd0a53c9306920e12fae76d6527c8c64746b2932ec0b652bf7319f6a33d
- MD5 64d78b9a8a72ab0ad6d474ae40bcd7da
- SHA1 f6e9fb5172fa82a9ae07ede9deb114f39bb2b772
- SHA512 42ff9c84321af1d9252c320f2c7553d710bb76482fe291b7e1bb6bf4ee39408b13747fa030ddd877ef346e71ccf57272c08312ae0c2e7d611b084b17b822a467
- SSDEEP 24576:5uggkV4Oo4oAQTGn3Rj8RQd6wrojHnwy6XyBRB+gUVUu7us9EEowGU2PY3XvbDQU:Ng2o4o9+RAR+lr5X2CPOTxDG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Formbook family
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modiloader family
- Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/2936-400-0x0000000000400000-0x0000000000449000-memory.dmp family_formbook behavioral2/memory/2936-398-0x0000000000400000-0x0000000001400000-memory.dmp family_formbook - ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/3060-11-0x0000000002EB0000-0x0000000003EB0000-memory.dmp modiloader_stage2 - Executes dropped EXE 2 IoCs
pid Process 3060 x.exe 2936 yutpunmjE.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3060 set thread context of 2936 3060 x.exe 79 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yutpunmjE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 3060 x.exe 2936 yutpunmjE.exe 2936 yutpunmjE.exe 2936 yutpunmjE.exe 2936 yutpunmjE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 3060 4460 WScript.exe 78 PID 4460 wrote to memory of 3060 4460 WScript.exe 78 PID 4460 wrote to memory of 3060 4460 WScript.exe 78 PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe PID 3060 wrote to memory of 0 3060 x.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sample photos and drawings.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Public\yutpunmjE.exeC:\\Users\\Public\\yutpunmjE.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2936
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\x.exe
- Size 1.6MB
- SHA256 72f31dab1df33ef9d5ff1fe768c234bc718c6728a5076317104e440aaec7761f
- MD5 cf63e4db9d5cda05de03a2676f26e46c
- SHA1 c9212fdc2160849dc566b6fd1a5e8353941e5f9b
- SHA512 5209ca5963cad72a633f2331d6425f6b94ea7c309eca657140ce301caffcc6b1a7a9f6f0c7d26b43e05e514301fac4896c850d3e9f353d3e382f4343e13a9314
- SSDEEP 24576:UjOpBayIR+Oh64DsLTlxu4KhdRPtLXL733T1T/ReKIwHzt7+zzp:UHvmTVmLL733TNOwB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\yutpunmjE.exe
- Size 66KB
- SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
- MD5 c116d3604ceafe7057d77ff27552c215
- SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
- SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
- SSDEEP 1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
- MD5 SHA1 SHA512 SSDEEP