Analysis

  • max time kernel
    142s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 08:29

General

  • Target

    proformaXfaturaXpdf.exe

  • Size

    1.2MB

  • MD5

    703eeb530cbd41d86e20113624a18bd7

  • SHA1

    997930463f0362f53c5f9ee26afed94eff148505

  • SHA256

    90f18e453ea2b0c1fa4d84d95499ab3bfd11db81a54caa2702cd3749f62c9dec

  • SHA512

    89c1361a73c963985db922ec7d72e670f42eb09a2deba287ad535b93ce5e1c30aab53ea1a4e0395346b5647f060ec6f56650cb302d5a5db54d1e5fdd7a314e49

  • SSDEEP

    24576:iFoEhCKAXS/1+O9P1Bza+78soKoxm5OST6Iytld3BIwbgKcQrE/k2+RVN:iF9ii/1+O9P1BB8soKXx7ytldxzV

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\proformaXfaturaXpdf.exe
    "C:\Users\Admin\AppData\Local\Temp\proformaXfaturaXpdf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 708
      2⤵
      • Program crash
      PID:2560

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\CabAF35.tmp

          Filesize

          61KB

          MD5

          f3441b8572aae8801c04f3060b550443

          SHA1

          4ef0a35436125d6821831ef36c28ffaf196cda15

          SHA256

          6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

          SHA512

          5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

        • C:\Users\Admin\AppData\Local\Temp\TarAF67.tmp

          Filesize

          163KB

          MD5

          9441737383d21192400eca82fda910ec

          SHA1

          725e0d606a4fc9ba44aa8ffde65bed15e65367e4

          SHA256

          bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

          SHA512

          7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

        • memory/2808-0-0x00000000003E0000-0x00000000003E1000-memory.dmp

          Filesize

          4KB

        • memory/2808-1-0x0000000002E40000-0x0000000003E40000-memory.dmp

          Filesize

          16.0MB

        • memory/2808-2-0x0000000002E40000-0x0000000003E40000-memory.dmp

          Filesize

          16.0MB

        • memory/2808-4-0x0000000000400000-0x0000000000546000-memory.dmp

          Filesize

          1.3MB

        • memory/2808-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

          Filesize

          4KB