Analysis
-
max time kernel
134s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
03-10-2022 07:00
General
-
Target
Order..dzk.exe
-
Size
799KB
-
MD5
bc4d68921f3d4e3f78f163d91f9de1a9
-
SHA1
fca24f27874510ee1828d64872614b31d600017f
-
SHA256
f78bdd699a470015ac9ee1e7c6fc9b5f77f724e1f771fa2bdb345df9444486ce
-
SHA512
d7043d4a0a517fea47d887e2a9bba7ce80bb5d6e1419005d21d2320d5fc8fbe33d7a1d3cc1dcca9e89abb116beaf7548679d5726c847c4cf13760f779ab3e1da
-
SSDEEP
24576:c2BykORCD21sNaxp6fo+ax+6m23m23mbpbZe:c2BjOkS2Lo+ax+6m23m23mbpbZe
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 56 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order..dzk.exe"C:\Users\Admin\AppData\Local\Temp\Order..dzk.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/828-54-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB
-
memory/828-55-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-57-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-58-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-59-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-60-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-61-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-62-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-63-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-64-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-65-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-66-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-67-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-69-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-68-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-70-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-71-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-76-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-75-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-77-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-74-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-78-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-73-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-72-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-79-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-80-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-85-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-84-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-88-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-89-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-87-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-95-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-98-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-97-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-96-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-99-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-94-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-101-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-103-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-104-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-102-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-100-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-93-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-92-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-91-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-90-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-86-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-83-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-82-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-81-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-105-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-106-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-107-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-108-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-109-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-110-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB
-
memory/828-116-0x0000000001D30000-0x0000000001D5A000-memory.dmpFilesize
168KB