Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
01-03-2023 08:08
General
-
Target
56b3f950f86319870611c364b467719a.exe
-
Size
722KB
-
MD5
56b3f950f86319870611c364b467719a
-
SHA1
ef7e6573e08777e8496f3c5f68fb34d545c9fdcb
-
SHA256
f55ce0741ed4615bae5646c644b3a971323ac344b12693495d5749c688d5d489
-
SHA512
43d0da4349ff27c99d7184dfa810527591b158fc2a053b6e289ee2d2ee9a3da5389c90213e82ab5a4d9abd7af43d5f5db007d3d4d66dc2620409cafe48ead147
-
SSDEEP
12288:HoDzEcLL4ZjVUi0EosOijSmrXO9Ax3mIEDs0wvw1BjSxFrXhy:HG4s0jVLyijxZx2qI1BSxdXE
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\56b3f950f86319870611c364b467719a.exe"C:\Users\Admin\AppData\Local\Temp\56b3f950f86319870611c364b467719a.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iexpress.exeC:\Windows\System32\iexpress.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1824-153-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/1824-157-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/1824-158-0x0000000003D60000-0x0000000003D70000-memory.dmpFilesize
64KB
-
memory/1824-156-0x0000000003E90000-0x00000000041DA000-memory.dmpFilesize
3.3MB
-
memory/1824-155-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2296-152-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2296-151-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/2296-140-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/2296-139-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2296-137-0x00000000024B0000-0x00000000024DC000-memory.dmpFilesize
176KB
-
memory/2296-136-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/3180-166-0x0000000002E20000-0x0000000002EF6000-memory.dmpFilesize
856KB
-
memory/3180-159-0x0000000002C10000-0x0000000002CD3000-memory.dmpFilesize
780KB
-
memory/3180-169-0x0000000002E20000-0x0000000002EF6000-memory.dmpFilesize
856KB
-
memory/3904-160-0x0000000000F70000-0x0000000000F97000-memory.dmpFilesize
156KB
-
memory/3904-164-0x0000000000BD0000-0x0000000000BFD000-memory.dmpFilesize
180KB
-
memory/3904-165-0x0000000002F90000-0x00000000032DA000-memory.dmpFilesize
3.3MB
-
memory/3904-163-0x0000000000BD0000-0x0000000000BFD000-memory.dmpFilesize
180KB
-
memory/3904-167-0x0000000002DB0000-0x0000000002E3F000-memory.dmpFilesize
572KB
-
memory/3904-162-0x0000000000F70000-0x0000000000F97000-memory.dmpFilesize
156KB