Analysis
- max time kernel
144s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
22/11/2023, 12:38
General
- Target SecuriteInfo.com.Win32.TrojanX-gen.3937.5321.exe
- Size 1.8MB
- Sample231122-pt2k7scd76
- SHA256 abec20fbb427ace85e7ba8b8bc265fd00b8e2499b0667ba621ed1e8a98cc7c1f
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.3937.5321.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.3937.5321.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/232-0-0x0000000002360000-0x0000000002361000-memory.dmp
memory/232-1-0x0000000004750000-0x0000000005750000-memory.dmp
memory/232-2-0x0000000000400000-0x00000000005D0000-memory.dmp
memory/232-3-0x0000000004750000-0x0000000005750000-memory.dmp
memory/232-5-0x0000000000400000-0x00000000005D0000-memory.dmp
memory/232-6-0x0000000002360000-0x0000000002361000-memory.dmp