Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 13:25
Static task
static1
Behavioral task
behavioral1
Sample
H3409D.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
H3409D.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
H3409D.exe
-
Size
770KB
-
MD5
8173c4f1aab9e70409d795b904d1b30b
-
SHA1
ca3a7fa60e5f910647316450c257a11aab8e7299
-
SHA256
d69785e0fa78ddb451072e232164234057e49a7671695c33c0db64adba871e44
-
SHA512
0815ae280189619c39bbffc0b75a93d499363c1389c2e3c98eadce769f47d775e81be2bf3d293b6c4bb9e51a41d1398f2130c93983152adc19e25918835c6cb9
-
SSDEEP
12288:gKLJyUZiUWf0sSEpcwXybqAsespUI2PRl/NnLLm:fly1UWf0s7qwXwI1pUDZl/NnLL
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/972-133-0x00000000022B0000-0x00000000022DC000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4832 972 WerFault.exe H3409D.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
H3409D.exepid process 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe 972 H3409D.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\H3409D.exe"C:\Users\Admin\AppData\Local\Temp\H3409D.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 17962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 972 -ip 9721⤵