Analysis
-
max time kernel
144s -
max time network
202s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 15:16
Behavioral task
behavioral1
Sample
d3b7c49f73cff511bde8f109d1c9793a8e69f45d267d138132d1d3f15c0638af.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d3b7c49f73cff511bde8f109d1c9793a8e69f45d267d138132d1d3f15c0638af.exe
Resource
win10v2004-20221111-en
General
-
Target
d3b7c49f73cff511bde8f109d1c9793a8e69f45d267d138132d1d3f15c0638af.exe
-
Size
18KB
-
MD5
0387ff80eb7542ca431bcefbaf5dd3bb
-
SHA1
43e2a313d1b90fe734e5196d9efe72b05832c355
-
SHA256
d3b7c49f73cff511bde8f109d1c9793a8e69f45d267d138132d1d3f15c0638af
-
SHA512
700196bec8190b6e9dc2adec2ef6f39e16143b87c9ec2c4e5cae5ff05235b02a54168ca21f157c94fe97fb264ca3ea99bc51bd7c27e307af4b82a9047603a856
-
SSDEEP
384:VEw7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1CzcVDp+c6nne:VEw7wkHOYEGPvCaV4pLzb1fVDpl
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/688-55-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule behavioral1/memory/688-55-0x0000000000400000-0x0000000000414000-memory.dmp upx