Analysis
-
max time kernel
92s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 22:12
Static task
static1
Behavioral task
behavioral1
Sample
8d7b89b7d47ebb2fbb7b5389305ce8b8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8d7b89b7d47ebb2fbb7b5389305ce8b8.exe
Resource
win10v2004-20231222-en
General
-
Target
8d7b89b7d47ebb2fbb7b5389305ce8b8.exe
-
Size
697KB
-
MD5
8d7b89b7d47ebb2fbb7b5389305ce8b8
-
SHA1
2f92d8cdacfbc5203f9dff10d9354f45ab5bf22e
-
SHA256
6cc38a350d313916a19f09b2163dbae59fcbc58ad50b534fd9809c69e400f5e3
-
SHA512
13655c623db30b7cde28ab81a5ed75821667344f96818931a9a40699a51b697a68261ebc66dc10f640cc7d27181687759246a70c09e2183db521c203640abf77
-
SSDEEP
12288:2r8X1ZJNDbQR958MuiadvwM+w4D4cLwy4xQzF3Z4mxxc2V/eU4BUNyM83t:2rO1LNAR95R4d4MxicsQmXc2I3UNW
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/4580-30-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral2/memory/2080-34-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2080 rejoice813.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_rejoice813.exe rejoice813.exe File opened for modification C:\Windows\SysWOW64\_rejoice813.exe rejoice813.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2080 set thread context of 2072 2080 rejoice813.exe 97 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe -
Program crash 4 IoCs
pid pid_target Process procid_target 2424 4580 WerFault.exe 84 3944 2080 WerFault.exe 91 4964 2072 WerFault.exe 97 1016 2080 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4580 wrote to memory of 2080 4580 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 91 PID 4580 wrote to memory of 2080 4580 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 91 PID 4580 wrote to memory of 2080 4580 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 91 PID 2080 wrote to memory of 2072 2080 rejoice813.exe 97 PID 2080 wrote to memory of 2072 2080 rejoice813.exe 97 PID 2080 wrote to memory of 2072 2080 rejoice813.exe 97 PID 2080 wrote to memory of 2072 2080 rejoice813.exe 97 PID 2080 wrote to memory of 2072 2080 rejoice813.exe 97 PID 2080 wrote to memory of 1356 2080 rejoice813.exe 95 PID 2080 wrote to memory of 1356 2080 rejoice813.exe 95 PID 4580 wrote to memory of 4084 4580 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 101 PID 4580 wrote to memory of 4084 4580 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 101 PID 4580 wrote to memory of 4084 4580 8d7b89b7d47ebb2fbb7b5389305ce8b8.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d7b89b7d47ebb2fbb7b5389305ce8b8.exe"C:\Users\Admin\AppData\Local\Temp\8d7b89b7d47ebb2fbb7b5389305ce8b8.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 3242⤵
- Program crash
PID:2424
-
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 3243⤵
- Program crash
PID:3944
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵PID:1356
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 124⤵
- Program crash
PID:4964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 6883⤵
- Program crash
PID:1016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""2⤵PID:4084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4580 -ip 45801⤵PID:2292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2080 -ip 20801⤵PID:2860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2072 -ip 20721⤵PID:956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2080 -ip 20801⤵PID:3268
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD523e0114e054a29647a8cd87a0392ec84
SHA1427082482ed3b88b8e0d4a61f93eb459419b4073
SHA256549ba097d22fc041de2f767d7c802b528b349f1c0346a5c644349c0512a80dfa
SHA51217146399f5a7ee5ce42a29840d35be61f7b78ec247e3848559a0908b9293da8006355df16740887c6bbbae4e58a6c6522a3336234748ab9e52eeb80cd7dabd02
-
Filesize
697KB
MD58d7b89b7d47ebb2fbb7b5389305ce8b8
SHA12f92d8cdacfbc5203f9dff10d9354f45ab5bf22e
SHA2566cc38a350d313916a19f09b2163dbae59fcbc58ad50b534fd9809c69e400f5e3
SHA51213655c623db30b7cde28ab81a5ed75821667344f96818931a9a40699a51b697a68261ebc66dc10f640cc7d27181687759246a70c09e2183db521c203640abf77