Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
11/10/2023, 19:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target file.exe
- Size 1.1MB
- Sample231011-xptc2afe91
- SHA256 27c3f876bb12269c818bc4c2efc8c741ca3b6b1b618f631d951e59fa62be90d5
- MD5 05decb2dd9fdf2e69709e1a37382845b
- SHA1 ca897d95692e2ff37340c7aca4c0ca85ed8e7c5d
- SHA512 eefc81d89a506582a52c9a4bd583b0015e3e84bf847356254edbfdcd262ef1ccce403e92a8404c88f02a58681bfff4e16f47af2b34a6999e482f6e331a75c583
- SSDEEP 12288:qE8C9kdWdEPv8zuVEdh9a6OLqvabdpmBkt1VEmA00P85Be2fgmv1qsM8HcZG3g5J:qEPudPPOuVsaoAjlD0P83H5M8OG3
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/2216-1-0x0000000002B40000-0x0000000003B40000-memory.dmp modiloader_stage2 - Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 30 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 32 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe PID 2216 wrote to memory of 0 2216 file.exe