Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
06/01/2024, 10:40
General
-
Target
5e9bb60122d93db3a8ef2e1a1ae14c10.exe
-
Size
291KB
-
MD5
5e9bb60122d93db3a8ef2e1a1ae14c10
-
SHA1
8d3d911755da70d844b4641bce7d56734026569c
-
SHA256
7e02e6066a752cecfed2ceb30869406b35cdc88f729eac3b8b5ca326c21c72be
-
SHA512
93fc9d4fb2c07f3d9db9885e98e09b814554831968f888c8093227d1fd6d22f1d81ee33123ebd7c748c37b8da3e43cae74892052da02901bb359f16b79c2eddc
-
SSDEEP
6144:OfFwEbXxN63f3wka6k1XRqASJNZXNIGbIPJPWYwNuUYJ6v1wX:OfZhN6Va6kOFJNZdtbIPJPTwNuUm+1wX
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e9bb60122d93db3a8ef2e1a1ae14c10.exe"C:\Users\Admin\AppData\Local\Temp\5e9bb60122d93db3a8ef2e1a1ae14c10.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 1761⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
1.1MB
-
Filesize
4.0MB
-
Filesize
1.1MB