Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 07:05
General
-
Target
11b723557777da86f39e7b65b4ee42df.exe
-
Size
156KB
-
MD5
11b723557777da86f39e7b65b4ee42df
-
SHA1
50eeaf0f00b0c0e3ff01a492e410455d3764a269
-
SHA256
3f2651020961acfaba84fc8049f5edd479af3cfab7079f0c9bb12e52dd5f2f8c
-
SHA512
ec3b85efd971d6959233349d179dddeb65ecf75cecc760b4fbd5ef4bdea2b4b7274c861237d2c3fab27559663a519e109d0eb647b2d669a86d5b3da3943fcac9
-
SSDEEP
1536:bsCqYOQXNCNNWa00qJQhLTg7CCobPtPJpFHSOuopPcuR8Ebs28CW:BOmNJlULTg7+Ptxp1SaPcu2w6p
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\RECYCLER\wmsj.exeC:\RECYCLER\wmsj.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11b723557777da86f39e7b65b4ee42df.exe"C:\Users\Admin\AppData\Local\Temp\11b723557777da86f39e7b65b4ee42df.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5282fc99747c30c211fe88e21de8cb216
SHA16b0d356aa7080eca91112d7f75b9b48570dd0709
SHA2562bc432d27bfdd56176991d7c1b90f01ffe0d2442f5a8041272ea73ee2d241a63
SHA512889e4d77667d8e1653c6d0c4b5232067ed46d26bf6578132db7a7f95783a1d78bd3ba29626afe2e9a2552585e366d62b52a3f655de30d5a168fe71f13ad0cbc8
-
Filesize
156KB
MD511b723557777da86f39e7b65b4ee42df
SHA150eeaf0f00b0c0e3ff01a492e410455d3764a269
SHA2563f2651020961acfaba84fc8049f5edd479af3cfab7079f0c9bb12e52dd5f2f8c
SHA512ec3b85efd971d6959233349d179dddeb65ecf75cecc760b4fbd5ef4bdea2b4b7274c861237d2c3fab27559663a519e109d0eb647b2d669a86d5b3da3943fcac9
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB