Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13-10-2023 21:34
General
-
Target
Kopija potvrde placanja.exe
-
Size
947KB
-
MD5
68da0fc8238154152646c59bb3bc5eda
-
SHA1
5fb2ee22d31f84faaaa57c0562cf800c99397622
-
SHA256
54f5267dea7dfa571027e7ec1f9e8518231c8a9baff0cf49e098ecbaf86e051a
-
SHA512
b24a96ee73bd19e9781ed521e1541245fcfdf1b20bd57e37f0f1307e7f10240e8f1a8b78c9fba2fbed4b2735cc4de837c96b082ee6a1b83a4c70afc73d070e46
-
SSDEEP
12288:+L5nRsetSwLTUSkRj2keaAigv4ixgKbR5hjy3H31RDHW4Qek5Dko:+RHSMTL3aKAod5h23H3fGes
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Program crash 1 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kopija potvrde placanja.exe"C:\Users\Admin\AppData\Local\Temp\Kopija potvrde placanja.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 17562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4636 -ip 46361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
972KB
-
Filesize
4KB