Analysis

  • max time kernel
    172s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 04:23

General

  • Target

    2805ce182e1675cc95aeee36afe349e3.exe

  • Size

    703KB

  • MD5

    2805ce182e1675cc95aeee36afe349e3

  • SHA1

    7da3f5506945407f8f8e1adcacc1723687350a2c

  • SHA256

    62960caf3d007638be89631e502733f30c42a9ba0269e8c00457c9dec10e9136

  • SHA512

    287f6ceefc0315595135576a2579ce24f5eaad299a27a7af41062e88fa2ced0914ee83614300b48e2c2515b25f9e393644c3a83bddf310cbea2e4cce8d467d1f

  • SSDEEP

    12288:SnE1eDMrSuUFA+/ARNb43cRuM7bUwYgsI4pR8fCH3eVg2m+7ph:42HfUG+oRNb43chyXI4pRUU3e7f

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2805ce182e1675cc95aeee36afe349e3.exe
    "C:\Users\Admin\AppData\Local\Temp\2805ce182e1675cc95aeee36afe349e3.exe"
    1⤵
      PID:3140

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3140-0-0x0000000002290000-0x0000000002291000-memory.dmp

      Filesize

      4KB

    • memory/3140-2-0x0000000002720000-0x000000000273B000-memory.dmp

      Filesize

      108KB

    • memory/3140-8-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/3140-10-0x0000000002290000-0x0000000002291000-memory.dmp

      Filesize

      4KB