Overview

overview

10

Static

static

cbb39e6283...9f.exe

windows7-x64

10

cbb39e6283...9f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    25s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cbb39e6283a85b7c49b607129d2f61e7ca86462cfa8aa58db84f67f7cc76ff9f.exe

  • Size

    40KB

  • MD5

    12e31522e619aedb08fd6ee5d4ec6c89

  • SHA1

    e4bcc5f41b36cabac7ac25be812136005c3dbea1

  • SHA256

    cbb39e6283a85b7c49b607129d2f61e7ca86462cfa8aa58db84f67f7cc76ff9f

  • SHA512

    eb5986b5e2982a904bd16cd80a5c5c85a08b22a21a940568def68f21cfabd9d7ddfe8ec9fba99fc5268b02108bd18bb3a34ea77ea75b333385d6a7b9735aa0cf

  • SSDEEP

    768:B4B2JGYVNfV6vrFDPwp2Gt7YHN0m5vcdXwPXDzHvzExAPOE/3MwVrJ7H8oWXRrKk:BC2oAfIrJwp2Gium5vcxwPzzvzEx6L/q

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbb39e6283a85b7c49b607129d2f61e7ca86462cfa8aa58db84f67f7cc76ff9f.exe
    "C:\Users\Admin\AppData\Local\Temp\cbb39e6283a85b7c49b607129d2f61e7ca86462cfa8aa58db84f67f7cc76ff9f.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files\Common Files\Microsoft Shared\MSInfo\atmQQ2.dll
    Filesize

    21KB

    MD5

    bb3f830c1032018214a0ed1b4dfd11fa

    SHA1

    53b963a581fb822029c15014df4ce1abea529dc1

    SHA256

    ed1185747f67aa142a8f7bee262ff1c217712fa952d79be80b852d57159e9a50

    SHA512

    77ec175271722f97567bbaca05e80b814bdc1db233a6e96d62c712ae4829cbda7745816ee6bb71ad12df74c2f9b24c50a5cbfdad3d01970fe8795403ba063d40

    Download Submit
  • memory/552-54-0x0000000075131000-0x0000000075133000-memory.dmp
    Filesize

    8KB

    Download
  • memory/552-56-0x0000000000400000-0x0000000000435000-memory.dmp
    Filesize

    212KB

    Download
  • memory/552-57-0x0000000000220000-0x0000000000244000-memory.dmp
    Filesize

    144KB

    Download