Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/01/2024, 13:33
General
-
Target
777eb6912c3e2aba4051fbd27ab8d77d.exe
-
Size
152KB
-
MD5
777eb6912c3e2aba4051fbd27ab8d77d
-
SHA1
6946fa0a5bbbd88e4c1a4e91dbb296adf74a4f2e
-
SHA256
1dfec9551e64df9bf78f9a72030e8f4cfc62f494fc6d564d99f5cdcc90578805
-
SHA512
d2776d8c4aba0fee4abc2ca003f707ce19f0d6482a9b7e538f5b5f1c6e12978cb181b80ef46fbe6cda0c90c143d06382a3cb7b78a082f64f0a67edb89ceaebb3
-
SSDEEP
1536:MsCqYOQXNCejiv6qZQQAe55DvLPBtJpFHSOuopFWnj7r:UOmNzjifQvenTV3p1SaQP
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 5 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\777eb6912c3e2aba4051fbd27ab8d77d.exe"C:\Users\Admin\AppData\Local\Temp\777eb6912c3e2aba4051fbd27ab8d77d.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\wmsj.exeC:\Windows\wmsj.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD50205ae0d092565db3707c574d960d557
SHA1cc769bf4e8900e473142d9851ad6beddd7ca411d
SHA256e97fec169e9467cd7f05e53c1c4a2a7c5047054ff6c35d2069174c956b8859d8
SHA5125e1206a8d7a9fe08d010d0db8832a699ed9064853768a9648bf3c95ba5614984f3b2ad4d5740d0c9cbea52ee55e616b4ee983108cbfd350da00731513ef6bd68
-
Filesize
152KB
MD5777eb6912c3e2aba4051fbd27ab8d77d
SHA16946fa0a5bbbd88e4c1a4e91dbb296adf74a4f2e
SHA2561dfec9551e64df9bf78f9a72030e8f4cfc62f494fc6d564d99f5cdcc90578805
SHA512d2776d8c4aba0fee4abc2ca003f707ce19f0d6482a9b7e538f5b5f1c6e12978cb181b80ef46fbe6cda0c90c143d06382a3cb7b78a082f64f0a67edb89ceaebb3
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB