Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
06-12-2023 11:41
General
-
Target
bonifico n.1205233350402700_pdf.exe
-
Size
1.8MB
-
MD5
a18d53a15adcd104da65f264a173918d
-
SHA1
e0c5fc276261c539786a092860ff479f169fa359
-
SHA256
6862f026a60890d6a790f7783addd5e86e60384289476989454a0154be4a09b8
-
SHA512
4b0471dd32222ed956cbb7ab4ef996bf448a240ed578f7ce4aa98bc118c1a574597f3368e3cf62029f3c2c4ea46a9eeecce366014d606a027ed9199984e1f386
-
SSDEEP
49152:iytH9q1rUPS1qXtfRGHKpk3H8eiTwHFimH9jIrMKSIa+GGXHIfd2Ddk6L+O/:i+HqkS1qXtfRGHKpk3H8eiTwHFimH9jm
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bonifico n.1205233350402700_pdf.exe"C:\Users\Admin\AppData\Local\Temp\bonifico n.1205233350402700_pdf.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-0-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/864-1-0x0000000002CF0000-0x0000000003CF0000-memory.dmpFilesize
16.0MB
-
memory/864-2-0x0000000002CF0000-0x0000000003CF0000-memory.dmpFilesize
16.0MB
-
memory/864-4-0x0000000000400000-0x00000000005D5000-memory.dmpFilesize
1.8MB
-
memory/864-6-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB