Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 07:53
General
-
Target
12afb327aca7c5a3804ef419fe7748be.exe
-
Size
22KB
-
MD5
12afb327aca7c5a3804ef419fe7748be
-
SHA1
6f2b2e4722eac83c6b60189b12b5034789475290
-
SHA256
4b45485c38d938d10fa08d306088ce8d3594fca4f93550ad8f51da5ed1fa9ac9
-
SHA512
539db7a22a70f3b2fc8339b8fa4253cfab20381d1479e02c50e7ce92b36d86fc04d0cd823c44aff7abbe0261b3811b640d88f8e8de464a6e4b4fbd096e86e9a4
-
SSDEEP
384:Mk7+GOuV7pIIP943hYNA2zB1HDnpirQx+iOxntpJXPVKMx2vugTtK4/RP5/7:My+oa094RYN5v4sxXOxnHFPVKMQvrtjp
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Windows directory 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12afb327aca7c5a3804ef419fe7748be.exe"C:\Users\Admin\AppData\Local\Temp\12afb327aca7c5a3804ef419fe7748be.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\WinRaR\WinRaR.exeC:\Windows\WinRaR\WinRaR.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD563fc1e1a519eb5cf6e267221415f524b
SHA1efe8296d329a7a9e35b6567525af22ced15031cc
SHA2563567f24014f0ad244315787fd099a7625aee64b3bac0e87343b37e9b94036c39
SHA512b0635d3b77da3faef35c68501e20b4c72e303756f7d48fc4bc499d1ad4a544f42ef8ca729c66cfc5f5abe257574cc4e0e2ccc9412ac79de24dac95407dc769df
-
Filesize
22KB
MD512afb327aca7c5a3804ef419fe7748be
SHA16f2b2e4722eac83c6b60189b12b5034789475290
SHA2564b45485c38d938d10fa08d306088ce8d3594fca4f93550ad8f51da5ed1fa9ac9
SHA512539db7a22a70f3b2fc8339b8fa4253cfab20381d1479e02c50e7ce92b36d86fc04d0cd823c44aff7abbe0261b3811b640d88f8e8de464a6e4b4fbd096e86e9a4
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
120KB