Analysis

  • max time kernel
    133s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/01/2024, 09:20

General

  • Target

    INVOICE.XLS..exe

  • Size

    2.0MB

  • MD5

    110a3f8081fd420ebb5251f8ec1d454b

  • SHA1

    3b2d87d5e5a014372b0b75e5ed4d49396a33f72e

  • SHA256

    7ac13d34e6adb000c65f0c6c3b68fb790f0a1a5a1042be6da4351b96bb94cae8

  • SHA512

    81322593c772ab927c50d2b5ccc30302d4f08fff235130c1c4c2d0fbcebfe617642d73be93f3c3a9731ac24214d70a719299db79e0b19a377abfefcc95a6bdf8

  • SSDEEP

    49152:pqAodhXjnxf2hd7c7mvrq0gOPYaF5P0R:pqAo2hd7Ymu0gOpuR

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INVOICE.XLS..exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE.XLS..exe"
    1⤵
      PID:2808

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2808-0-0x00000000003D0000-0x00000000003D1000-memory.dmp

            Filesize

            4KB

          • memory/2808-1-0x0000000002F40000-0x0000000003F40000-memory.dmp

            Filesize

            16.0MB

          • memory/2808-2-0x0000000002F40000-0x0000000003F40000-memory.dmp

            Filesize

            16.0MB

          • memory/2808-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

            Filesize

            4KB

          • memory/2808-5-0x0000000000400000-0x0000000000608000-memory.dmp

            Filesize

            2.0MB