Analysis
-
max time kernel
29s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 12:52
General
-
Target
1fedfc97d52dc13ed6cebde7519bf7a8.exe
-
Size
730KB
-
MD5
1fedfc97d52dc13ed6cebde7519bf7a8
-
SHA1
a5586c63c2e4eb65ce4c3f1a3070e7e01fbba470
-
SHA256
4851611ebb2a33698be0ed454cbaf495d86925ef472c6cdc5b799e259c573b3c
-
SHA512
aa67f72731ff7045ae899d4ba2cf861149c8524c92e38de2eee0bb707745a87bff6a0c7210abdf3a3ebfb49e3d34edec4588f3ba167368c8a8b64a311aaa829e
-
SSDEEP
12288:Y9nTQAiVtuiwlF4w+dGnS0LzPgm8cryDYTS7b9ihfJEdp86nH3UqCILs9:Y9nNMmlyeS0LzgsryuS7b9ihz6Ox
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 35 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fedfc97d52dc13ed6cebde7519bf7a8.exe"C:\Users\Admin\AppData\Local\Temp\1fedfc97d52dc13ed6cebde7519bf7a8.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"2⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"3⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"4⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"5⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"6⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"7⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"8⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"9⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"10⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"11⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"12⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"13⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"14⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"15⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"16⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"17⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"18⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"19⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"20⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"21⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"22⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"23⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"24⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"25⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"26⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"27⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"28⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"29⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"30⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"31⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"32⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"33⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"34⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"35⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"36⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"37⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"38⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"39⤵
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"40⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD54040200ab608ec1bdd655b7d93f0d590
SHA1e9eddb0f73c55e24072a5db657b892e7389fcc80
SHA25691f1de13f74e6e9888d2e5e1107d420a0faa9a89c19bd298230a16a5d9233081
SHA51221fe819b78dd0c3e02e52626bd95b3ebc732af8b51beaa009ca6b1ce0accc6899d7feb91f4d53a0d42efb33a88ab63fe609f3511c50f85dc313383ea1ae31449
-
Filesize
381KB
MD5718c7b4ff3e8aa530f2fde3be8707e44
SHA1a2bbb72de713eda64bda4b7006e395a8f7057f33
SHA2569ad0bb5cb00d8e07d614f15a376869c2bdd3ce8cf21e122639c6a27529ed92a7
SHA51201aa5c4d0232218a5246c94937bf1a8041ca6a9cfccdbe856f5091af87d238673bf7510f86fe39c45400c03720707a71a292d864530cf21c3eb226cd9cd7ae40
-
Filesize
92KB
MD55677cd42f71be632e9bbe96b07db10f4
SHA1f99ffdd8f979a6c92fb2b29682bfbba4e1261f1e
SHA256b67b6920e1bb372471da5648c5c279fb0c98522245b4a9bda38a74df0d86d4f4
SHA5128489d9d3888d0276c5cec4fe1a2acf6353d4d83355ac15c4c56a6622b2682fd39c4df31779872e5871040409df05a82f39fdf90b371645132a0c0a24822e1464
-
Filesize
730KB
MD51fedfc97d52dc13ed6cebde7519bf7a8
SHA1a5586c63c2e4eb65ce4c3f1a3070e7e01fbba470
SHA2564851611ebb2a33698be0ed454cbaf495d86925ef472c6cdc5b799e259c573b3c
SHA512aa67f72731ff7045ae899d4ba2cf861149c8524c92e38de2eee0bb707745a87bff6a0c7210abdf3a3ebfb49e3d34edec4588f3ba167368c8a8b64a311aaa829e
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
4KB
-
Filesize
4KB