Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
05-12-2022 05:46
General
-
Target
82431451824fd614072b75e3cd3dd461a96ab7e254894643d2a90683f2a54e26.exe
-
Size
108KB
-
MD5
7fe2d93d5a56e0633433f28f30c36839
-
SHA1
e51ecdb0607b420aa657b2df23528c76c4a7fc4e
-
SHA256
82431451824fd614072b75e3cd3dd461a96ab7e254894643d2a90683f2a54e26
-
SHA512
981612fb3a575d16db4989806c54e84b2e18432c54697b625b6cdd96d7a364d7dd87d459fab5949782905c7f5ac06c9ada986fd426912fb912e7e4b6c5ba562a
-
SSDEEP
3072:C1+MJKrUnFYY5z1i0Nmbi5fJBNqw0G0uvoutR:CIrPj0NmWtNqrNuvoSR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82431451824fd614072b75e3cd3dd461a96ab7e254894643d2a90683f2a54e26.exe"C:\Users\Admin\AppData\Local\Temp\82431451824fd614072b75e3cd3dd461a96ab7e254894643d2a90683f2a54e26.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5335889891640a647b7b0d755066d6b53
SHA1f077c6eefdefd57a50a0e947bf24f119d4146238
SHA256b9f95ff822e91c1b84a48af1379c59abf4f2d8dfcdd0362a47bdd4ef0834cc1f
SHA512acc00c04bd0b3c46d0036e2c0815a6ea226528ff02fbcff9ddbc2f64eec60afa9444f610ec191344d22cff89fac3eda37e4c991220427c94a3e4ca6d0225c3fa
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
8KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB