Analysis
- max time kernel
153s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
11/11/2023, 07:32
General
- Target BL-DOCS.exe
- Size 1.4MB
- Sample231111-jcykbsde39
- SHA256 9dbe21429d77afca07940928b39d0e7c9d994ea9d10a651ccd5189d4522be1cf
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BL-DOCS.exe"C:\Users\Admin\AppData\Local\Temp\BL-DOCS.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/8-0-0x0000000002380000-0x0000000002381000-memory.dmp
memory/8-1-0x0000000002A30000-0x000000000898F000-memory.dmp
memory/8-2-0x0000000000400000-0x0000000000576000-memory.dmp
memory/8-3-0x0000000002A30000-0x000000000898F000-memory.dmp
memory/8-5-0x0000000000400000-0x0000000000576000-memory.dmp
memory/8-6-0x0000000002380000-0x0000000002381000-memory.dmp