Overview

overview

10

Static

static

dcdd046f3e...c6.exe

windows7-x64

10

dcdd046f3e...c6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2022 19:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dcdd046f3e45d2bf76cd39f6ee732ddfc69695320d581efe4ccb99a231d9fac6.exe

  • Size

    40KB

  • MD5

    00c57ab724a2f49bc710fe06b1848f00

  • SHA1

    68f194c459e02a4d51156f48f0c1b154af877210

  • SHA256

    dcdd046f3e45d2bf76cd39f6ee732ddfc69695320d581efe4ccb99a231d9fac6

  • SHA512

    370160d7a56e5746d765279dce2f8988813c6743f7a9dc1be3f108c0bac17ab9c6e994acb32d251cd6764fa9ee8b0109e6f16ba88024ef936c5cb1566042eb3b

  • SSDEEP

    768:B4B2JGYVNfV6vrFDPwp2Gt7YHN0m5vcdXwPXDzHvzExAPOE/3MwVrJ7H8oWXRrKD:BC2oAfIrJwp2Gium5vcxwPzzvzEx6L/9

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcdd046f3e45d2bf76cd39f6ee732ddfc69695320d581efe4ccb99a231d9fac6.exe
    "C:\Users\Admin\AppData\Local\Temp\dcdd046f3e45d2bf76cd39f6ee732ddfc69695320d581efe4ccb99a231d9fac6.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll
    Filesize

    21KB

    MD5

    ac61896f84cb387764f4f324d19959d9

    SHA1

    e91f352f691f10229a29fadf412d9a4cb0d9f0aa

    SHA256

    01796e601684a59035ab1f375cb51836a3f0ff8b30dcf6e6458eb3a2e8b16da0

    SHA512

    ca2d617afc6d2d608563d58b2385ea28254d9da7ce743153543f4172e96c651246068aae7546bce7cdf7b6ac17e8295c0a8b278dc877aaa3fc27c2a510bbc358

    Download Submit

  • C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll
    Filesize

    21KB

    MD5

    ac61896f84cb387764f4f324d19959d9

    SHA1

    e91f352f691f10229a29fadf412d9a4cb0d9f0aa

    SHA256

    01796e601684a59035ab1f375cb51836a3f0ff8b30dcf6e6458eb3a2e8b16da0

    SHA512

    ca2d617afc6d2d608563d58b2385ea28254d9da7ce743153543f4172e96c651246068aae7546bce7cdf7b6ac17e8295c0a8b278dc877aaa3fc27c2a510bbc358

    Download Submit

  • memory/1960-134-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1960-135-0x00000000008B0000-0x00000000008D4000-memory.dmp

    Filesize

    144KB

    Download