Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 01:51
Static task
static1
Behavioral task
behavioral1
Sample
b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe
Resource
win10v2004-20220812-en
General
-
Target
b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe
-
Size
40KB
-
MD5
9ab685270cfe5e7b3f8260d26a2e5270
-
SHA1
4563ba7ea94e232c73d69a913bb81b60d3f724ff
-
SHA256
b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb
-
SHA512
4f6d2e2a754edc0a9e00de9dbddc0320a3f502e3978edd45c453805c4202fb662d8874136b6fd892f0b84b807bfe2181abe11cb0d59428c66e7ce232c0a05adc
-
SSDEEP
768:B4B2JGYVNfV6vrFDPwp2Gt7YHN0m5vcdXwPXDzHvzExAPOE/3MwVrJ7H8oWXRrKA:BC2oAfIrJwp2Gium5vcxwPzzvzEx6L/6
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4456-135-0x00000000023A0000-0x00000000023C4000-memory.dmp modiloader_stage2 -
Loads dropped DLL 2 IoCs
Processes:
b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exepid process 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe -
Drops file in Program Files directory 1 IoCs
Processes:
b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exepid process 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exepid process 4456 b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe"C:\Users\Admin\AppData\Local\Temp\b9294fb477be5606eddf28636b53de3d7dc3bbfbdf6d602e1a50535c782248fb.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dllFilesize
21KB
MD5b79d13cd1a8c0d06ab2deb5370ae2f1e
SHA1e628d4990c5a5fa58a2014d6199d2a9bd23051ec
SHA25618e9a017a496261d38d830f92456799af7473b28711572d8ec12d52d2f393561
SHA512dcafeb4a7923a174d5b78ded261a781724b09cd545103fd95b84412c019ef393a1acc6a0480d96d4873230ab04a54db2519a3e01b7fcd5d2e554826cbd9bedfc
-
C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dllFilesize
21KB
MD5b79d13cd1a8c0d06ab2deb5370ae2f1e
SHA1e628d4990c5a5fa58a2014d6199d2a9bd23051ec
SHA25618e9a017a496261d38d830f92456799af7473b28711572d8ec12d52d2f393561
SHA512dcafeb4a7923a174d5b78ded261a781724b09cd545103fd95b84412c019ef393a1acc6a0480d96d4873230ab04a54db2519a3e01b7fcd5d2e554826cbd9bedfc
-
memory/4456-134-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4456-135-0x00000000023A0000-0x00000000023C4000-memory.dmpFilesize
144KB