Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230831-en - resource tags
- submitted
04/09/2023, 14:08
General
- Target Termak_Portugal_0823023.bat.exe
- Size 1.4MB
- Sample230904-rfj54sha47
- SHA256 af32c757b3b59d23990779fe8408dd75bb4657812193df7bbbf041d1228c7604
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Termak_Portugal_0823023.bat.exe"C:\Users\Admin\AppData\Local\Temp\Termak_Portugal_0823023.bat.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4664-0-0x0000000002340000-0x0000000002341000-memory.dmp
memory/4664-1-0x0000000003290000-0x0000000004290000-memory.dmp
memory/4664-2-0x0000000003290000-0x0000000004290000-memory.dmp
memory/4664-4-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4664-5-0x0000000002340000-0x0000000002341000-memory.dmp