Analysis
-
max time kernel
189s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 21:12
Behavioral task
behavioral1
Sample
d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe
Resource
win10v2004-20220812-en
General
-
Target
d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe
-
Size
156KB
-
MD5
c3f0b25e50b2685000a29938dbb628c7
-
SHA1
d2cc2bbae7a30e2693fbad4a9893351c2aa246f9
-
SHA256
d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76
-
SHA512
5f1b257d23e9a2ee3496c2de99bbef34ec0a486683f9163b1fd33f18d916d4efc453cf6a91ef5fcb68cf3ba2865950f68c72e868619341008364342cc30ccd98
-
SSDEEP
3072:oGbHwx3GsAFyQbXO0kwXmFRqAh+7QouCv8BATTy+zL9GwqRlcBapeEdmIMyXp:oG7u6jrkwvKaXR0cyYLF6lcBapBdd
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4784-132-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 behavioral2/memory/4784-133-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule behavioral2/memory/4784-132-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/4784-133-0x0000000000400000-0x000000000046F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe" d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exepid process 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe 4784 d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe"C:\Users\Admin\AppData\Local\Temp\d948953956363ca948d26e9a14b56b4e5b4f9d50a5671b5c815ba2addef90d76.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵