Analysis
-
max time kernel
113s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 23:46
Static task
static1
Behavioral task
behavioral1
Sample
a1c287a3ca407a74a477c47c59892a35.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a1c287a3ca407a74a477c47c59892a35.exe
Resource
win10v2004-20220812-en
General
-
Target
a1c287a3ca407a74a477c47c59892a35.exe
-
Size
855KB
-
MD5
a1c287a3ca407a74a477c47c59892a35
-
SHA1
5a3623e0bca2e8db1fb9e6e75594dfcc06120cab
-
SHA256
35f2e83ae1824192895db4652379e09d403315098c1e864719b5660df7bda548
-
SHA512
2c63b495089ac51e51ea893b3fecd6e755ad3a0805bcef492c41349d9075d35df882f23374ce1ab5974005a8b6622e7fb3f947745ae53572c243c0ca957d5cec
-
SSDEEP
12288:Hkcz1cfQZIGdTetgXN+j5kiGNtlvSsg8J/2p9Uy1/GGmnAPU4wuvYe+msnzu8xde:HR6f4wtgXUVkp1KsgSaH1/GGmArzGzk
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 63 IoCs
Processes:
resource yara_rule behavioral2/memory/4152-132-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-135-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-134-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-137-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-136-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-138-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-140-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-139-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-142-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-141-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-144-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-145-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-143-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-146-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-148-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-147-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-150-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-149-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-152-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-151-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-153-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-155-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-154-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-157-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-156-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-159-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-158-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-161-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-160-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-163-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-162-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-165-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-164-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-166-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-167-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-168-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-169-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-171-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-172-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-173-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-170-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-174-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-175-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-176-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-177-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-178-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-179-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-180-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-181-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-182-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-183-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-184-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-185-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-186-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-187-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-188-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-189-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-190-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-191-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-192-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-193-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-195-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 behavioral2/memory/4152-194-0x0000000002850000-0x000000000287A000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2600 4152 WerFault.exe a1c287a3ca407a74a477c47c59892a35.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1c287a3ca407a74a477c47c59892a35.exe"C:\Users\Admin\AppData\Local\Temp\a1c287a3ca407a74a477c47c59892a35.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 18002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4152 -ip 41521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4152-132-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-135-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-134-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-137-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-136-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-138-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-140-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-139-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-142-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-141-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-144-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-145-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-143-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-146-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-148-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-147-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-150-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-149-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-152-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-151-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-153-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-155-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-154-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-157-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-156-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-159-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-158-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-161-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-160-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-163-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-162-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-165-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-164-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-166-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-167-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-168-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-169-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-171-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-172-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-173-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-170-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-174-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-175-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-176-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-177-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-178-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-179-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-180-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-181-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-182-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-183-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-184-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-185-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-186-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-187-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-188-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-189-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-190-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-191-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-192-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-193-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-195-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB
-
memory/4152-194-0x0000000002850000-0x000000000287A000-memory.dmpFilesize
168KB