Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-04-2021 08:10
Static task
static1
Behavioral task
behavioral1
Sample
c4cd874423d9026b16b370d5fa812471.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c4cd874423d9026b16b370d5fa812471.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
c4cd874423d9026b16b370d5fa812471.exe
-
Size
637KB
-
MD5
c4cd874423d9026b16b370d5fa812471
-
SHA1
b1c514708b9611056cce378a8c7d8f2b12e4e8df
-
SHA256
0a049a6f200348e229ebaa13728cd0d19de4839c741d4faec3dd64207860153d
-
SHA512
ba5a92674f30bbcb2c4f4552bebb6f226da9ceb5a67d8692d3615353c85a241d9c501732e83b0825f59c6bf272df5cdb66f67136d89fe7f9898b20c018d3f501
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c4cd874423d9026b16b370d5fa812471.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fcizmp = "C:\\Users\\Public\\Libraries\\pmzicF.url" c4cd874423d9026b16b370d5fa812471.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
c4cd874423d9026b16b370d5fa812471.exedescription pid process target process PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe PID 2436 wrote to memory of 4036 2436 c4cd874423d9026b16b370d5fa812471.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4cd874423d9026b16b370d5fa812471.exe"C:\Users\Admin\AppData\Local\Temp\c4cd874423d9026b16b370d5fa812471.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2436-114-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/2436-116-0x0000000002380000-0x000000000239A000-memory.dmpFilesize
104KB
-
memory/4036-119-0x0000000000000000-mapping.dmp
-
memory/4036-120-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/4036-122-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/4036-123-0x0000000010590000-0x000000001060C000-memory.dmpFilesize
496KB
-
memory/4036-124-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/4036-125-0x0000000000CA0000-0x0000000000DEA000-memory.dmpFilesize
1.3MB