Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-10-2022 04:14
Static task
static1
Behavioral task
behavioral1
Sample
9911f9c939737fb6e26a49ef08ebcb85281cf6b850b85ff00bf49f81a0e46a4c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9911f9c939737fb6e26a49ef08ebcb85281cf6b850b85ff00bf49f81a0e46a4c.exe
Resource
win10v2004-20220812-en
General
-
Target
9911f9c939737fb6e26a49ef08ebcb85281cf6b850b85ff00bf49f81a0e46a4c.exe
-
Size
952KB
-
MD5
4244160422a6e2f2e2ccae5437de4466
-
SHA1
1f5b19d4781f3e2e108e6b24b8578a39205d1812
-
SHA256
9911f9c939737fb6e26a49ef08ebcb85281cf6b850b85ff00bf49f81a0e46a4c
-
SHA512
649d29ad7989b58b9b904fd41da311e0c9cee631c3fd0762fa1cd6b5d88e08bc68d770dbe1af6579b2b8683b98770570a2045aa0e5f82fade915cc9bf58a8593
-
SSDEEP
24576:CyQCv11PbnjANYPAj81OUo6w7tNTa9W8AoqiVNW:CIP6sOUzM
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 54 IoCs
Processes:
resource yara_rule behavioral1/memory/1148-55-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-95-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-94-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-93-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-92-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-91-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-90-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-89-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-87-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-88-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-86-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-85-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-84-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-83-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-81-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-82-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-80-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-79-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-78-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-77-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-76-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-75-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-74-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-73-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-72-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-71-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-70-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-69-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-68-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-67-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-66-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-65-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-64-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-63-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-62-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-61-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-60-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-59-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-58-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-57-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-96-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-99-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-98-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-97-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-100-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-104-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-103-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-102-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-101-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-114-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-108-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-107-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-106-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2 behavioral1/memory/1148-105-0x0000000000380000-0x00000000003E4000-memory.dmp modiloader_stage2
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1148-54-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/1148-55-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-95-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-94-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-93-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-92-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-91-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-90-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-89-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-87-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-88-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-86-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-85-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-84-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-83-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-81-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-82-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-80-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-79-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-78-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-77-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-76-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-75-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-74-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-73-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-72-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-71-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-70-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-69-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-68-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-67-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-66-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-65-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-64-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-63-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-62-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-61-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-60-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-59-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-58-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-57-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-96-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-99-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-98-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-97-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-100-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-104-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-103-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-102-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-101-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-114-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-108-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-107-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-106-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB
-
memory/1148-105-0x0000000000380000-0x00000000003E4000-memory.dmpFilesize
400KB