Analysis
-
max time kernel
205s -
max time network
223s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 02:44
General
-
Target
0c141a2b17924cc649f3d6bbc009d9e3.exe
-
Size
23KB
-
MD5
0c141a2b17924cc649f3d6bbc009d9e3
-
SHA1
3a2bd776650d4b2eb956b3afb65a6baab7fe31cb
-
SHA256
ca2bfeae499ca3a4562136658b27410776453dbde021b491abd47a9e5c0d9603
-
SHA512
eaa4030f57f94ee4304be4ee786e4dba592c827f237100f0d3b949d40391cfe3b6b941f8e125a5f7065fed268f77465f8c161e557c3207adc372b087e1e4138e
-
SSDEEP
384:GyMN0GOufss1iStjLAhpgz3UVhSascDBDS56UvH2Dd1mQjD8:GxN050iSt/AjjAascveUDmQ
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0c141a2b17924cc649f3d6bbc009d9e3.exe"C:\Users\Admin\AppData\Local\Temp\0c141a2b17924cc649f3d6bbc009d9e3.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\tcpip.exeC:\Windows\SysWOW64\tcpip.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD50c141a2b17924cc649f3d6bbc009d9e3
SHA13a2bd776650d4b2eb956b3afb65a6baab7fe31cb
SHA256ca2bfeae499ca3a4562136658b27410776453dbde021b491abd47a9e5c0d9603
SHA512eaa4030f57f94ee4304be4ee786e4dba592c827f237100f0d3b949d40391cfe3b6b941f8e125a5f7065fed268f77465f8c161e557c3207adc372b087e1e4138e
-
Filesize
84KB
-
Filesize
52KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
84KB