Analysis
-
max time kernel
135s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
d8e816beef37da3d57af00fb9ede57883fef49332f830e1b23dd2f0681946c2c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d8e816beef37da3d57af00fb9ede57883fef49332f830e1b23dd2f0681946c2c.exe
Resource
win10v2004-20220901-en
General
-
Target
d8e816beef37da3d57af00fb9ede57883fef49332f830e1b23dd2f0681946c2c.exe
-
Size
292KB
-
MD5
f20071416e20bfa50224e11d1c9b78b7
-
SHA1
d7d905b66073a250ea641d883f10f929d32bea45
-
SHA256
d8e816beef37da3d57af00fb9ede57883fef49332f830e1b23dd2f0681946c2c
-
SHA512
fc5bbd128ce5d19d327af5e87a8752154485f04819287e622014f4d4d34ce9bb3548bfd3a90596eaf94acff255ab37626f9fd4ef7a8aaefb087291f51bf0406a
-
SSDEEP
6144:/uJRgBpSC/3kCQKWFQ9xjdACcBzTsqy9/hyW881b:2JRgB7/UyX9xDaTByfF
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3248-133-0x0000000000400000-0x00000000004A4000-memory.dmp modiloader_stage1 behavioral2/memory/3248-134-0x0000000000400000-0x00000000004A4000-memory.dmp modiloader_stage1 -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
d8e816beef37da3d57af00fb9ede57883fef49332f830e1b23dd2f0681946c2c.exedescription ioc process File opened for modification \??\PhysicalDrive0 d8e816beef37da3d57af00fb9ede57883fef49332f830e1b23dd2f0681946c2c.exe