Analysis
-
max time kernel
25s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 02:29
Static task
static1
Behavioral task
behavioral1
Sample
220b823d727551efd859751572cba34411ade93b56f1664dc7b609710d420c44.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
220b823d727551efd859751572cba34411ade93b56f1664dc7b609710d420c44.exe
Resource
win10v2004-20221111-en
General
-
Target
220b823d727551efd859751572cba34411ade93b56f1664dc7b609710d420c44.exe
-
Size
336KB
-
MD5
057e95403d5a39c08d1070b8faa8effd
-
SHA1
6273d4654f6c21be062c7a180e067d4c1f221783
-
SHA256
220b823d727551efd859751572cba34411ade93b56f1664dc7b609710d420c44
-
SHA512
624caed69feae33cd654f42cd92c47898401a18f9da2aee25efc8118e50b1af2b7b3d5fa9d95d05139492217b2ffd9c9fa627577460f81a0f05eb212073baf65
-
SSDEEP
6144:OG4sB1u9VZkl4xFbj4k6ugEEFl8J9JbM5tQdiml/nDR8FLMFcBlr:OGHBorklyj4jugZFoQtQ4mWFL8cBlr
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1072-55-0x0000000000400000-0x0000000000530000-memory.dmp modiloader_stage2 behavioral1/memory/1072-56-0x0000000000400000-0x0000000000530000-memory.dmp modiloader_stage2 behavioral1/memory/1072-57-0x0000000000400000-0x0000000000530000-memory.dmp modiloader_stage2
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1072-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1072-55-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/1072-56-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/1072-57-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB