Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:59
Static task
static1
Behavioral task
behavioral1
Sample
75081e2bedc18514148ad0e22469c0f8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
75081e2bedc18514148ad0e22469c0f8.exe
Resource
win10v2004-20231222-en
General
-
Target
75081e2bedc18514148ad0e22469c0f8.exe
-
Size
345KB
-
MD5
75081e2bedc18514148ad0e22469c0f8
-
SHA1
5a7e38ea6a6d170f39e3dc87de02917998ce5664
-
SHA256
0c9fe3d6a5ea1cf5235e67c71c28bd99418dac341c1619030d6e8c71284ea355
-
SHA512
51e48e966aa7fd47af64a9cc4198073f9b85b2482c56422b9980c2b29b55af3fbad64931cb06d84dd2c9894f612b3fac141cccc7e75d165d62806e617b977071
-
SSDEEP
6144:aaS9i0/hIC5gMpJW9v6CATRZoy39ciwE/68vLn7J3MZD1Ti/:aJiqhHpJAfAVZoUcitv7yD1q
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3464-3-0x0000000000400000-0x00000000004C2000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
75081e2bedc18514148ad0e22469c0f8.exedescription pid process target process PID 3464 set thread context of 4556 3464 75081e2bedc18514148ad0e22469c0f8.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
75081e2bedc18514148ad0e22469c0f8.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt 75081e2bedc18514148ad0e22469c0f8.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3580 4556 WerFault.exe svchost.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
75081e2bedc18514148ad0e22469c0f8.exedescription pid process target process PID 3464 wrote to memory of 4556 3464 75081e2bedc18514148ad0e22469c0f8.exe svchost.exe PID 3464 wrote to memory of 4556 3464 75081e2bedc18514148ad0e22469c0f8.exe svchost.exe PID 3464 wrote to memory of 4556 3464 75081e2bedc18514148ad0e22469c0f8.exe svchost.exe PID 3464 wrote to memory of 4556 3464 75081e2bedc18514148ad0e22469c0f8.exe svchost.exe PID 3464 wrote to memory of 4556 3464 75081e2bedc18514148ad0e22469c0f8.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75081e2bedc18514148ad0e22469c0f8.exe"C:\Users\Admin\AppData\Local\Temp\75081e2bedc18514148ad0e22469c0f8.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 123⤵
- Program crash
PID:3580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4556 -ip 45561⤵PID:2916
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3464-3-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/3464-2-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/4556-1-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/4556-4-0x0000000000B80000-0x0000000000B80000-memory.dmp