Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 22:27
Behavioral task
behavioral1
Sample
54bfbe067c074db7fb5c9d90bccd8460.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
54bfbe067c074db7fb5c9d90bccd8460.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
54bfbe067c074db7fb5c9d90bccd8460.exe
-
Size
699KB
-
MD5
54bfbe067c074db7fb5c9d90bccd8460
-
SHA1
33e788fd7e190ac96650e1e75dbd7f6ea96b87e0
-
SHA256
867c85168812654c8ded87e802a0b3e220362d3b5822aef7ed9cc75be1961d79
-
SHA512
710bad26e6c862f39b9010f3d24e97eb0e0896dcb4c70f035bf7475937e744709be5c3d750b22ec818056c3ddf226a005912ebfb430fd235b2ef4d5b411b6d6d
-
SSDEEP
12288:dFUuKT63xR5kuzwb3cIgnVKbW3G2voAIYrqOAuaM+TW7vr8:3pD3xoukcIajfvxdeuaM+TW7T8
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/2552-3-0x0000000000400000-0x00000000004C0000-memory.dmp modiloader_stage2 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt 54bfbe067c074db7fb5c9d90bccd8460.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2552 wrote to memory of 4856 2552 54bfbe067c074db7fb5c9d90bccd8460.exe 90 PID 2552 wrote to memory of 4856 2552 54bfbe067c074db7fb5c9d90bccd8460.exe 90 PID 2552 wrote to memory of 4856 2552 54bfbe067c074db7fb5c9d90bccd8460.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\54bfbe067c074db7fb5c9d90bccd8460.exe"C:\Users\Admin\AppData\Local\Temp\54bfbe067c074db7fb5c9d90bccd8460.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\system32\mstsc.exe"2⤵PID:4856
-