Analysis
-
max time kernel
129s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2022 15:00
Static task
static1
Behavioral task
behavioral1
Sample
Requisition ,,xp.exe
Resource
win7-20220718-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Requisition ,,xp.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Requisition ,,xp.exe
-
Size
626KB
-
MD5
1dd6591858428a58b81dfbd26507cf87
-
SHA1
157fdf999bfa380e886d442f25eddea3e26eca04
-
SHA256
c2b2e774a10f9b1de9375018b051a0a898bf90065d49a0d716de4bcfefd9abe5
-
SHA512
30ad1d64cc494b3ac29f987e9c1c5a2b1ac6aba2215b92df3fa10a8c933a56a4289518a5380c04b15d88242c1d73016a7b5c52c68e5cfe9e767647725db2865a
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Requisition ,,xp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wlzwzeyeh = "C:\\Users\\Public\\Libraries\\heyezwzlW.url" Requisition ,,xp.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5068 3128 WerFault.exe Requisition ,,xp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Requisition ,,xp.exe"C:\Users\Admin\AppData\Local\Temp\Requisition ,,xp.exe"1⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 19522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3128 -ip 31281⤵