Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2022 13:11
Static task
static1
Behavioral task
behavioral1
Sample
a88a06aa18fc804c54a5d6f5426afa44e1255a273ad595086ee848caae92e572.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a88a06aa18fc804c54a5d6f5426afa44e1255a273ad595086ee848caae92e572.exe
Resource
win10v2004-20220812-en
General
-
Target
a88a06aa18fc804c54a5d6f5426afa44e1255a273ad595086ee848caae92e572.exe
-
Size
952KB
-
MD5
c4a405912e3b0ef08ee227052c85d901
-
SHA1
41b1c8d2c0f3e051e18e75ce3220d9a78c743074
-
SHA256
a88a06aa18fc804c54a5d6f5426afa44e1255a273ad595086ee848caae92e572
-
SHA512
1be07fe3108ec5a528a9c987684f29a46d9ae3201745b1b03c5c8c585a2fae64b7fe133db2421f589e22244719cf40d0ad33cd7ee2ae77823525078b73bce019
-
SSDEEP
12288:k2ksTSQIilk0q5cIDt1NLMn5/ICYdqqog61uFSDo5ynuzFl2LUv0eMqnexYA1l/X:kDuSglk0GNE5yER1No5ynRxYA7/X
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3912-132-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-134-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-133-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-136-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-135-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-138-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-137-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-140-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-139-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-142-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-141-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-144-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-143-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-146-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-147-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-145-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-149-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-148-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-150-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-152-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-151-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-153-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-155-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-154-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-157-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-156-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-159-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-158-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-161-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-160-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-162-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-164-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-165-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-163-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-166-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-168-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-167-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-170-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-169-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-171-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-172-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-173-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-174-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-175-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-176-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-177-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-178-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-179-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-180-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-181-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-182-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-183-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-184-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-185-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-186-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-187-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-188-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-190-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-189-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-191-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-192-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-193-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-194-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2 behavioral2/memory/3912-195-0x0000000002AD0000-0x0000000002B31000-memory.dmp modiloader_stage2
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3912-132-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-134-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-133-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-136-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-135-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-138-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-137-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-140-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-139-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-142-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-141-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-144-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-143-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-146-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-147-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-145-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-149-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-148-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-150-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-152-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-151-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-153-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-155-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-154-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-157-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-156-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-159-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-158-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-161-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-160-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-162-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-164-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-165-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-163-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-166-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-168-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-167-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-170-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-169-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-171-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-172-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-173-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-174-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-175-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-176-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-177-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-178-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-179-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-180-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-181-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-182-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-183-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-184-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-185-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-186-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-187-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-188-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-190-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-189-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-191-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-192-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-193-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-194-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB
-
memory/3912-195-0x0000000002AD0000-0x0000000002B31000-memory.dmpFilesize
388KB