Analysis
- max time kernel
121s - max time network
120s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
03/12/2021, 10:51
General
- Target 48afd1f2e1c80cb7ba09ffa901e75617.exe
- Size 790KB
- Sample211203-mxtnnabbc6
- SHA256 1a77fe43c21c77b47c1ea009c8a7c082eb11abcfb48ff4375cce7edc0925e9c6
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader First Stage 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\48afd1f2e1c80cb7ba09ffa901e75617.exe"C:\Users\Admin\AppData\Local\Temp\48afd1f2e1c80cb7ba09ffa901e75617.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2432-115-0x0000000000680000-0x0000000000681000-memory.dmp
memory/2432-116-0x00000000027C1000-0x00000000027D5000-memory.dmp
memory/2432-117-0x0000000004510000-0x0000000004830000-memory.dmp