Analysis
-
max time kernel
91s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2024, 10:00
Behavioral task
behavioral1
Sample
841ed93df98943fe212fe564ad11ebf5.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
841ed93df98943fe212fe564ad11ebf5.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
841ed93df98943fe212fe564ad11ebf5.exe
-
Size
768KB
-
MD5
841ed93df98943fe212fe564ad11ebf5
-
SHA1
b9eeff2ab365f6880552f933c41e5ae0c1753ad6
-
SHA256
bc72b729a69a5f94a3a1b0f1c0d59c5755c0b6bd9a92dfbee6df31af2648effa
-
SHA512
8386a0b86f1c70aa3db5fec3e9cb559598bff07fd118eef9f1a57ea9eb18b01e37b54013761d12380a5223513fd669107bb3c3879223d48c088d996e039d143a
-
SSDEEP
12288:XLvWAG0LBRfBjU0RFD8/vHNSq7uRXda6Lu8hViXVzOBJd:XrionfBD/A/vHNSnRXsEhIFzOBJ
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/2980-1-0x0000000000400000-0x00000000004C0200-memory.dmp modiloader_stage2 -
resource yara_rule behavioral2/memory/2980-0-0x0000000000400000-0x00000000004C0200-memory.dmp upx behavioral2/memory/2980-1-0x0000000000400000-0x00000000004C0200-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3036 2980 WerFault.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\841ed93df98943fe212fe564ad11ebf5.exe"C:\Users\Admin\AppData\Local\Temp\841ed93df98943fe212fe564ad11ebf5.exe"1⤵PID:2980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 2282⤵
- Program crash
PID:3036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2980 -ip 29801⤵PID:400