Overview
overview
10Static
static
2006֮2009...��.htm
windows7-x64
12006֮2009...��.htm
windows10-2004-x64
12006֮2009...t2.exe
windows7-x64
102006֮2009...t2.exe
windows10-2004-x64
102006֮2009...il.vbs
windows7-x64
12006֮2009...il.vbs
windows10-2004-x64
12006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
2006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
12006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
12006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
1Analysis
-
max time kernel
38s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 02:38
Static task
static1
Behavioral task
behavioral1
Sample
2006֮2009ͨɱȾ/77169.org˵.htm
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2006֮2009ͨɱȾ/77169.org˵.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
2006֮2009ͨɱȾ/Project2.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
2006֮2009ͨɱȾ/Project2.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
2006֮2009ͨɱȾ/qqmail.vbs
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
2006֮2009ͨɱȾ/qqmail.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
2006֮2009ͨɱȾ/ĺڿͬ˽ѧѵ.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
2006֮2009ͨɱȾ/ĺڿͬ˽ѧѵ.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
2006֮2009ͨɱȾ/ĺڿͬ.url
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
2006֮2009ͨɱȾ/ĺڿͬ.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
2006֮2009ͨɱȾ/¿ƼIDC˾.url
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
2006֮2009ͨɱȾ/¿ƼIDC˾.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
2006֮2009ͨɱȾ/¿Ƽȫά.url
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
2006֮2009ͨɱȾ/¿Ƽȫά.url
Resource
win10v2004-20220812-en
General
-
Target
2006֮2009ͨɱȾ/Project2.exe
-
Size
336KB
-
MD5
057e95403d5a39c08d1070b8faa8effd
-
SHA1
6273d4654f6c21be062c7a180e067d4c1f221783
-
SHA256
220b823d727551efd859751572cba34411ade93b56f1664dc7b609710d420c44
-
SHA512
624caed69feae33cd654f42cd92c47898401a18f9da2aee25efc8118e50b1af2b7b3d5fa9d95d05139492217b2ffd9c9fa627577460f81a0f05eb212073baf65
-
SSDEEP
6144:OG4sB1u9VZkl4xFbj4k6ugEEFl8J9JbM5tQdiml/nDR8FLMFcBlr:OGHBorklyj4jugZFoQtQ4mWFL8cBlr
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral3/memory/1148-55-0x0000000000400000-0x0000000000530000-memory.dmp modiloader_stage2 behavioral3/memory/1148-56-0x0000000000400000-0x0000000000530000-memory.dmp modiloader_stage2 behavioral3/memory/1148-57-0x0000000000400000-0x0000000000530000-memory.dmp modiloader_stage2
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1148-54-0x0000000074C11000-0x0000000074C13000-memory.dmpFilesize
8KB
-
memory/1148-55-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/1148-56-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/1148-57-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB