Analysis
- max time kernel
43s - max time network
112s - platform
windows7_x64 - resource
win7 - submitted
15/10/2020, 17:12
Static task
static1
Behavioral task
behavioral1
Sample
b0890536bf460f2c4244a75f0752bee9.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b0890536bf460f2c4244a75f0752bee9.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target b0890536bf460f2c4244a75f0752bee9.exe
- Size 1.0MB
- Sample201015-kfxjsmgra2
- SHA256 855eaf42f771f65f72f7457ba7eb8e4f5ab99b7bc43fbb2fa1528820c2e01200
- MD5 b0890536bf460f2c4244a75f0752bee9
- SHA1 8fa8926f3717f20246867601d6885fb64af2dd2d
- SHA512 f2c0daa571a0c62092b3607598e11b87765d69ae9c3c5de01feef802497c82e5b26951858b223af5ab389ee040322b81d378c354e3ffef535489a9837b648612
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/1124-1-0x0000000004020000-0x000000000406E000-memory.dmp modiloader_stage2 - Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30 PID 1124 wrote to memory of 1952 1124 b0890536bf460f2c4244a75f0752bee9.exe 30