Analysis
-
max time kernel
142s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-04-2022 04:17
Static task
static1
Behavioral task
behavioral1
Sample
5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f.exe
Resource
win10v2004-20220414-en
General
-
Target
5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f.exe
-
Size
1.0MB
-
MD5
3112e3d3d3d97c54cf011ea5dd15e563
-
SHA1
3a40515aedaae14026ec6ebbee8e8cbf95a794ce
-
SHA256
5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f
-
SHA512
7555bd105c72a1a0ef595eed192b625cd9bb622e59ce26c0ac74f0fe1b44bb3db68ecf7d0f7251ea043192c4359c1da1171089d1b28f2aa2ce4c2ec41cdbd284
Malware Config
Extracted
modiloader
https://cdn.discordapp.com/attachments/762895490362638339/771588549140807691/Sxzucos
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 2 IoCs
resource yara_rule behavioral2/memory/4512-131-0x0000000004680000-0x0000000004690000-memory.dmp modiloader_stage1 behavioral2/memory/4512-138-0x00000000049E0000-0x00000000049F0000-memory.dmp modiloader_stage1 -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 1 IoCs
pid pid_target Process procid_target 4280 4512 WerFault.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f.exe"C:\Users\Admin\AppData\Local\Temp\5f151c5ffba68f39fc72de02d40005063ac18a975603ee2a42bd32571a56a75f.exe"1⤵PID:4512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 17682⤵
- Program crash
PID:4280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4512 -ip 45121⤵PID:3524