Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 15:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe
-
Size
1.1MB
-
MD5
22d3a3c2ef2230695bc95068c085439d
-
SHA1
a07bc44e9b4d2321db79e742c0ee94c22f0379df
-
SHA256
6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2
-
SHA512
092d839ae5a70b3930185ba4df76d737ec73a4d2978d5f09287dd893af336f321134d28f81be6dcb28392a054126808b78600bb6f10d4e576fec11f384bd3688
-
SSDEEP
12288:qE8C9kdWdEPv8zuVEdh9a6OLqvabdpmBkt1VEmA00P85Be2fgmv1qsM8HcZG3g5I:qEPudPPOuVsaoAjlD0P83H5M8OG3
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/1452-1-0x0000000002BB0000-0x0000000003BB0000-memory.dmp modiloader_stage2 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe PID 1452 wrote to memory of 0 1452 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe