Analysis
-
max time kernel
44s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 15:48
Static task
static1
Behavioral task
behavioral1
Sample
9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe
Resource
win10v2004-20221111-en
General
-
Target
9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe
-
Size
718KB
-
MD5
36f2b527a5f1fbb7f0117ddbec61740c
-
SHA1
b804a44dcf074ee1cefdefc2ba1100279882eda2
-
SHA256
9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71
-
SHA512
d69fb352f68ced77e41b93814820fa2fa3fa19acd7fc80b2826a2d32ff4ceaf0ec91ea1d0b0bfdd5be11980671999be83cca747a7de815cd59698ed743c2c63c
-
SSDEEP
12288:r83nplb2LlNYJBOXyATpkIXhUhdO/fyI7xAhOOdHMflVqY4XofQJuczq:A3npR2Ll+JBuDp9IdthdsfloY4XofYq
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1604-55-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1604-58-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1604-56-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1604-59-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1604-61-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 -
Drops file in Program Files directory 1 IoCs
Processes:
9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt 9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exedescription pid process target process PID 1604 wrote to memory of 1820 1604 9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe IEXPLORE.EXE PID 1604 wrote to memory of 1820 1604 9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe IEXPLORE.EXE PID 1604 wrote to memory of 1820 1604 9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe IEXPLORE.EXE PID 1604 wrote to memory of 1820 1604 9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe"C:\Users\Admin\AppData\Local\Temp\9155eea1f877c87050d5bef410fcaa8d4c75578262d7e87d5783cb732323ac71.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1604-54-0x0000000000400000-0x0000000000572000-memory.dmpFilesize
1.4MB
-
memory/1604-55-0x0000000000400000-0x0000000000572000-memory.dmpFilesize
1.4MB
-
memory/1604-58-0x0000000000400000-0x0000000000572000-memory.dmpFilesize
1.4MB
-
memory/1604-56-0x0000000000400000-0x0000000000572000-memory.dmpFilesize
1.4MB
-
memory/1604-59-0x0000000000400000-0x0000000000572000-memory.dmpFilesize
1.4MB
-
memory/1604-60-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/1604-61-0x0000000000400000-0x0000000000572000-memory.dmpFilesize
1.4MB