Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
03/12/2021, 10:51
General
- Target 48afd1f2e1c80cb7ba09ffa901e75617.exe
- Size 790KB
- Sample211203-mxtnnabbc6
- SHA256 1a77fe43c21c77b47c1ea009c8a7c082eb11abcfb48ff4375cce7edc0925e9c6
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader First Stage 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\48afd1f2e1c80cb7ba09ffa901e75617.exe"C:\Users\Admin\AppData\Local\Temp\48afd1f2e1c80cb7ba09ffa901e75617.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/320-55-0x0000000075981000-0x0000000075983000-memory.dmp
memory/320-56-0x0000000000230000-0x0000000000231000-memory.dmp
memory/320-57-0x00000000003E1000-0x00000000003F5000-memory.dmp
memory/320-58-0x0000000004EC0000-0x00000000051C3000-memory.dmp