Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 22:12
Static task
static1
Behavioral task
behavioral1
Sample
8d7b89b7d47ebb2fbb7b5389305ce8b8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8d7b89b7d47ebb2fbb7b5389305ce8b8.exe
Resource
win10v2004-20231222-en
General
-
Target
8d7b89b7d47ebb2fbb7b5389305ce8b8.exe
-
Size
697KB
-
MD5
8d7b89b7d47ebb2fbb7b5389305ce8b8
-
SHA1
2f92d8cdacfbc5203f9dff10d9354f45ab5bf22e
-
SHA256
6cc38a350d313916a19f09b2163dbae59fcbc58ad50b534fd9809c69e400f5e3
-
SHA512
13655c623db30b7cde28ab81a5ed75821667344f96818931a9a40699a51b697a68261ebc66dc10f640cc7d27181687759246a70c09e2183db521c203640abf77
-
SSDEEP
12288:2r8X1ZJNDbQR958MuiadvwM+w4D4cLwy4xQzF3Z4mxxc2V/eU4BUNyM83t:2rO1LNAR95R4d4MxicsQmXc2I3UNW
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral1/memory/2152-42-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2004-44-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2152-60-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2860 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2004 rejoice813.exe -
Loads dropped DLL 5 IoCs
pid Process 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 2944 WerFault.exe 2944 WerFault.exe 2944 WerFault.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_rejoice813.exe rejoice813.exe File opened for modification C:\Windows\SysWOW64\_rejoice813.exe rejoice813.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2004 set thread context of 2884 2004 rejoice813.exe 29 -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2944 2004 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2004 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 28 PID 2152 wrote to memory of 2004 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 28 PID 2152 wrote to memory of 2004 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 28 PID 2152 wrote to memory of 2004 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 28 PID 2004 wrote to memory of 2884 2004 rejoice813.exe 29 PID 2004 wrote to memory of 2884 2004 rejoice813.exe 29 PID 2004 wrote to memory of 2884 2004 rejoice813.exe 29 PID 2004 wrote to memory of 2884 2004 rejoice813.exe 29 PID 2004 wrote to memory of 2884 2004 rejoice813.exe 29 PID 2004 wrote to memory of 2884 2004 rejoice813.exe 29 PID 2004 wrote to memory of 2944 2004 rejoice813.exe 30 PID 2004 wrote to memory of 2944 2004 rejoice813.exe 30 PID 2004 wrote to memory of 2944 2004 rejoice813.exe 30 PID 2004 wrote to memory of 2944 2004 rejoice813.exe 30 PID 2152 wrote to memory of 2860 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 31 PID 2152 wrote to memory of 2860 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 31 PID 2152 wrote to memory of 2860 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 31 PID 2152 wrote to memory of 2860 2152 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d7b89b7d47ebb2fbb7b5389305ce8b8.exe"C:\Users\Admin\AppData\Local\Temp\8d7b89b7d47ebb2fbb7b5389305ce8b8.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 3203⤵
- Loads dropped DLL
- Program crash
PID:2944
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""2⤵
- Deletes itself
PID:2860
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD523e0114e054a29647a8cd87a0392ec84
SHA1427082482ed3b88b8e0d4a61f93eb459419b4073
SHA256549ba097d22fc041de2f767d7c802b528b349f1c0346a5c644349c0512a80dfa
SHA51217146399f5a7ee5ce42a29840d35be61f7b78ec247e3848559a0908b9293da8006355df16740887c6bbbae4e58a6c6522a3336234748ab9e52eeb80cd7dabd02
-
Filesize
697KB
MD58d7b89b7d47ebb2fbb7b5389305ce8b8
SHA12f92d8cdacfbc5203f9dff10d9354f45ab5bf22e
SHA2566cc38a350d313916a19f09b2163dbae59fcbc58ad50b534fd9809c69e400f5e3
SHA51213655c623db30b7cde28ab81a5ed75821667344f96818931a9a40699a51b697a68261ebc66dc10f640cc7d27181687759246a70c09e2183db521c203640abf77