Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2023 11:41
Static task
static1
Behavioral task
behavioral1
Sample
bonifico n.1205233350402700_pdf.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bonifico n.1205233350402700_pdf.exe
Resource
win10v2004-20231130-en
General
-
Target
bonifico n.1205233350402700_pdf.exe
-
Size
1.8MB
-
MD5
a18d53a15adcd104da65f264a173918d
-
SHA1
e0c5fc276261c539786a092860ff479f169fa359
-
SHA256
6862f026a60890d6a790f7783addd5e86e60384289476989454a0154be4a09b8
-
SHA512
4b0471dd32222ed956cbb7ab4ef996bf448a240ed578f7ce4aa98bc118c1a574597f3368e3cf62029f3c2c4ea46a9eeecce366014d606a027ed9199984e1f386
-
SSDEEP
49152:iytH9q1rUPS1qXtfRGHKpk3H8eiTwHFimH9jIrMKSIa+GGXHIfd2Ddk6L+O/:i+HqkS1qXtfRGHKpk3H8eiTwHFimH9jm
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/864-2-0x0000000002CF0000-0x0000000003CF0000-memory.dmp modiloader_stage2 -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 40 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 41 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-0-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/864-1-0x0000000002CF0000-0x0000000003CF0000-memory.dmpFilesize
16.0MB
-
memory/864-2-0x0000000002CF0000-0x0000000003CF0000-memory.dmpFilesize
16.0MB
-
memory/864-4-0x0000000000400000-0x00000000005D5000-memory.dmpFilesize
1.8MB
-
memory/864-6-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB