Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
11/10/2023, 19:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target file.exe
- Size 1.1MB
- Sample231011-xqdc7sff21
- SHA256 b15a8668037928b4cc574506dc96518162693d531de044e7adf67461a123b1e5
- MD5 2e6d90fb9fb763f7ee8213ff90bf663d
- SHA1 c766b1375aa220c3107b62a6cc350eba2f212d0b
- SHA512 cf87e621932cec3b25e4155ba34aca287be4cd348cb9876bbef58d5aedd95e7be2bb5c20e2e57791fb74a4f9daad725242a9e80181e49c85e740fb795d91a510
- SSDEEP 12288:qE8C9kdWdEPv8zuVEdh9a6OLqvabdpmBkt1VEmA00P85Be2fgmv1qsM8HcZG3g5W:qEPudPPOuVsaoAjlD0P83H5M8OG3
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/1232-1-0x0000000002B50000-0x0000000003B50000-memory.dmp modiloader_stage2 - Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 39 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 41 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe PID 1232 wrote to memory of 0 1232 file.exe