Overview

overview

10

Static

static

3

U prilogu ...un.exe

windows7-x64

10

U prilogu ...un.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2023 10:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    U prilogu je predracun.exe

  • Size

    826KB

  • MD5

    b7f605030c86e9c698e70b04cbf7b861

  • SHA1

    58f050c40ee2f597663dbf4e204c9480baeb415f

  • SHA256

    7382318f5904040997bf14967bce3df6b323bf03901976df75a9b0e822dc5db8

  • SHA512

    02401799637431ba8952a64ecc42b1c5b70d8b967520c137959ff4a7829e4a34742402363685a1c45d1f3a0c4225f5024eed84d90439625777e927bf9dc268c9

  • SSDEEP

    12288:RElktyzweXm40fStl4/ukRiZLTJ3r1XmXmF8KMrFiojZV:R0NweXJj4mk4TLmX48KMrFioj

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 48 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\U prilogu je predracun.exe
    "C:\Users\Admin\AppData\Local\Temp\U prilogu je predracun.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 676
      2⤵
      • Program crash
      PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Tar3DA4.tmp
    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    Download Submit
  • memory/1724-54-0x00000000002C0000-0x00000000002C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1724-55-0x0000000000400000-0x00000000004D4000-memory.dmp
    Filesize

    848KB

    Download
  • memory/1724-62-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-61-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-60-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-63-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-67-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-66-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-65-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-64-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-59-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-58-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-57-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-56-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-101-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-100-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-99-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-98-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-97-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-96-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-95-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-94-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-93-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-92-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-91-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-90-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-89-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-88-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-87-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-86-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-85-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-84-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-83-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-82-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-81-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-80-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-79-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-78-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-77-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-76-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-75-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-74-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-73-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-102-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-72-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-71-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-70-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-69-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-68-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1724-103-0x00000000004E0000-0x0000000000512000-memory.dmp
    Filesize

    200KB

    Download