Analysis
-
max time kernel
182s -
max time network
210s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 23:49
Static task
static1
Behavioral task
behavioral1
Sample
dbbd5f34648cc1a20d0022c47a6531a6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dbbd5f34648cc1a20d0022c47a6531a6.exe
Resource
win10v2004-20220812-en
General
-
Target
dbbd5f34648cc1a20d0022c47a6531a6.exe
-
Size
940KB
-
MD5
dbbd5f34648cc1a20d0022c47a6531a6
-
SHA1
84bc195e56cdc6804cb987af330608ef5b173a67
-
SHA256
f8612ea8ab764a3d09157a9b90dc418ec2a7b8af22b29ce63d375896f9ec9a28
-
SHA512
6d44509bfb38afe4490034736e20dc59cd97de0a4e8cdbdddcd353f7ba5a470a1288f6a2761fa31d4c81bfdf0f6dc8cd56581e27f138e783ecea3e520d9819b3
-
SSDEEP
24576:xuLJQ0+ai+JoMCXlTjcEa0s4Tj29W8AoqiVNWI:xUpRx+cEa0Q
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 62 IoCs
Processes:
resource yara_rule behavioral1/memory/1776-55-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-57-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-58-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-59-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-61-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-60-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-62-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-63-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-64-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-66-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-65-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-67-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-68-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-69-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-71-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-70-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-72-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-73-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-75-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-74-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-76-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-77-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-78-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-79-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-80-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-81-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-82-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-83-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-85-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-84-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-86-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-87-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-89-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-88-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-90-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-91-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-92-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-93-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-94-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-96-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-95-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-99-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-98-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-100-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-97-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-101-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-102-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-103-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-104-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-105-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-106-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-107-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-108-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-110-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-111-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-112-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-109-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-114-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-115-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-116-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-117-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2 behavioral1/memory/1776-113-0x0000000000310000-0x0000000000374000-memory.dmp modiloader_stage2
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1776-54-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/1776-55-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-57-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-58-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-59-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-61-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-60-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-62-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-63-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-64-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-66-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-65-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-67-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-68-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-69-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-71-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-70-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-72-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-73-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-75-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-74-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-76-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-77-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-78-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-79-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-80-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-81-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-82-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-83-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-85-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-84-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-86-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-87-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-89-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-88-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-90-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-91-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-92-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-93-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-94-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-96-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-95-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-99-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-98-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-100-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-97-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-101-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-102-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-103-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-104-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-105-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-106-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-107-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-108-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-110-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-111-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-112-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-109-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-114-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-115-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-116-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-117-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1776-113-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB