Analysis
- max time kernel
130s - max time network
132s - platform
windows7_x64 - resource
win7-20230712-en - resource tags
- submitted
21/07/2023, 16:28
General
- Target SecuriteInfo.com.Win32.DropperX-gen.16131.21279.exe
- Size 713KB
- Sample230721-tym1tsfh21
- SHA256 08ebb1861d8ba3d60d87967ec99a106a288119c1f871bc08bae31e55cee745cd
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 43 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.16131.21279.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.16131.21279.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 6882⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2404-54-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2404-59-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-69-0x0000000000400000-0x00000000004B9000-memory.dmp
memory/2404-70-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2404-74-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-73-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-72-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-71-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-75-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-76-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-77-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-78-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-79-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-80-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-81-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-82-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-83-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-84-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-85-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-89-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-88-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-87-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-86-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-90-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-91-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-93-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-92-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-94-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-95-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-97-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-96-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-98-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-99-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-100-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-101-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-102-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-103-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-104-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-105-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-106-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-107-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-108-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-109-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-110-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-111-0x0000000000370000-0x00000000003A0000-memory.dmp
memory/2404-112-0x0000000000370000-0x00000000003A0000-memory.dmp