Analysis
- max time kernel
139s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
02/02/2024, 16:35
General
- Target 8a01166610053cee278ae01f319bf532.exe
- Size 609KB
- Sample240202-t3pefscfgl
- SHA256 88271d6332330024797c7413d4048755fc42b1d0e57bdcef0e0e57c3d9e9f954
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 3 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 4 IoCs
- Program crash 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a01166610053cee278ae01f319bf532.exe"C:\Users\Admin\AppData\Local\Temp\8a01166610053cee278ae01f319bf532.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 3242⤵
- Program crash
-
-
C:\Windows\SysWOW64\Indxiwg.exeC:\Windows\system32\Indxiwg.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 3243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3412 -ip 34121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2056 -ip 20561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Deleteme.bat
Indxiwg.exe
memory/2056-64-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-61-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-68-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-67-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-66-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-65-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-80-0x0000000000400000-0x000000000056D000-memory.dmp
memory/2056-63-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-62-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-69-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-60-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-59-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-58-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/2056-57-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/2056-56-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/2056-55-0x0000000000A70000-0x0000000000AC4000-memory.dmp
memory/2056-54-0x0000000000400000-0x000000000056D000-memory.dmp
memory/3412-17-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-44-0x00000000022D0000-0x00000000022D1000-memory.dmp
memory/3412-21-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-22-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-25-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-24-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-26-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-23-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-27-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-28-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-29-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-30-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-31-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-32-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-34-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-33-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-35-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-36-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-37-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-38-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-39-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-41-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-40-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-42-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-43-0x00000000033E0000-0x00000000033FB000-memory.dmp
memory/3412-20-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-45-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3412-46-0x0000000002550000-0x0000000002551000-memory.dmp
memory/3412-49-0x0000000002600000-0x0000000002601000-memory.dmp
memory/3412-19-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-52-0x0000000000400000-0x000000000056D000-memory.dmp
memory/3412-18-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-0-0x0000000000400000-0x000000000056D000-memory.dmp
memory/3412-16-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-13-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-15-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-14-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3412-12-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/3412-11-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/3412-10-0x0000000002300000-0x0000000002301000-memory.dmp
memory/3412-9-0x0000000002480000-0x0000000002481000-memory.dmp
memory/3412-8-0x0000000002450000-0x0000000002451000-memory.dmp
memory/3412-7-0x0000000002460000-0x0000000002461000-memory.dmp
memory/3412-5-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/3412-6-0x00000000022E0000-0x00000000022E1000-memory.dmp
memory/3412-4-0x0000000002470000-0x0000000002471000-memory.dmp
memory/3412-3-0x0000000002310000-0x0000000002311000-memory.dmp
memory/3412-2-0x0000000002330000-0x0000000002331000-memory.dmp
memory/3412-84-0x0000000000400000-0x000000000056D000-memory.dmp
memory/3412-1-0x0000000000A60000-0x0000000000AB4000-memory.dmp