Analysis
-
max time kernel
142s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-04-2022 04:17
General
-
Target
5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f.exe
-
Size
1.0MB
-
MD5
3112e3d3d3d97c54cf011ea5dd15e563
-
SHA1
3a40515aedaae14026ec6ebbee8e8cbf95a794ce
-
SHA256
5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f
-
SHA512
7555bd105c72a1a0ef595eed192b625cd9bb622e59ce26c0ac74f0fe1b44bb3db68ecf7d0f7251ea043192c4359c1da1171089d1b28f2aa2ce4c2ec41cdbd284
Score
10/10
Malware Config
Extracted
Family
modiloader
C2
https://cdn.discordapp.com/attachments/762895490362638339/771588549140807691/Sxzucos
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f.exe"C:\Users\Admin\AppData\Local\Temp\5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 17682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4512 -ip 45121⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB