Analysis
- max time kernel
123s - max time network
129s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
15/11/2021, 08:30
General
- Target DHL_119040 документ о получении,pdf.exe
- Size 1.0MB
- Sample211115-kd64jahfd3
- SHA256 d0d6952f4459c50159f7a9142da641df17cae7dc758c9a34bdcd19765bea37bc
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader First Stage 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_119040 документ о получении,pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_119040 документ о получении,pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 3242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/368-58-0x0000000000370000-0x0000000000371000-memory.dmp
memory/752-55-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/752-56-0x0000000000261000-0x0000000000275000-memory.dmp