Analysis
-
max time kernel
188s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
05-01-2024 11:55
General
-
Target
10b304dfe3b1e67678ffd18f7c1d0760.exe
-
Size
199KB
-
MD5
10b304dfe3b1e67678ffd18f7c1d0760
-
SHA1
93d32b40423204a10db14bfa20644dd7b8f4bea6
-
SHA256
4f7b25d22322329d95411b2eff1ea5b4466e1163067dcf07aa9ace5584b11fe1
-
SHA512
a76da32aef9564f6f9f80807c8bce1e1cee78b5c76328c57e06b71cecf6f569d7338ac7596dc086af17c6d80f8b8e5ee1ea52316c5152f7dc0b71b0debfb6275
-
SSDEEP
3072:f2prjabNBC+XfYheMtTGBBIhWLpc15UXNxSNTA86PHS6Kout:ona3C+XJMtOqgLpeUVPHSJoS
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10b304dfe3b1e67678ffd18f7c1d0760.exe"C:\Users\Admin\AppData\Local\Temp\10b304dfe3b1e67678ffd18f7c1d0760.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mstsc.exeC:\Windows\system32\mstsc.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1924 -ip 19241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
556KB
-
Filesize
556KB
-
Filesize
556KB
-
Filesize
4KB
-
Filesize
556KB
-
Filesize
556KB