Analysis
- max time kernel
143s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
03/02/2024, 22:29
General
- Target 8d83768b151d2efde1fc4692e39b4a41.exe
- Size 609KB
- Sample240203-2d9m4abdh8
- SHA256 40a3268a8ea94299a2135fc021fe25b907694463c9380fbfbc6c7e834aa6294b
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 3 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 4 IoCs
- Program crash 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d83768b151d2efde1fc4692e39b4a41.exe"C:\Users\Admin\AppData\Local\Temp\8d83768b151d2efde1fc4692e39b4a41.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 3242⤵
- Program crash
-
-
C:\Windows\SysWOW64\Indxiwg.exeC:\Windows\system32\Indxiwg.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 3243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3592 -ip 35921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4476 -ip 44761⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Deleteme.bat
Indxiwg.exe
memory/3592-7-0x0000000002470000-0x0000000002471000-memory.dmp
memory/3592-8-0x0000000002450000-0x0000000002451000-memory.dmp
memory/3592-3-0x0000000002420000-0x0000000002421000-memory.dmp
memory/3592-14-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3592-13-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/3592-12-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3592-11-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/3592-10-0x0000000002410000-0x0000000002411000-memory.dmp
memory/3592-9-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3592-31-0x0000000000A30000-0x0000000000A84000-memory.dmp
memory/3592-0-0x0000000000400000-0x000000000056D000-memory.dmp
memory/3592-15-0x0000000002550000-0x0000000002551000-memory.dmp
memory/3592-5-0x0000000002400000-0x0000000002401000-memory.dmp
memory/3592-18-0x0000000002600000-0x0000000002601000-memory.dmp
memory/3592-6-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/3592-2-0x0000000002440000-0x0000000002441000-memory.dmp
memory/3592-1-0x0000000000A30000-0x0000000000A84000-memory.dmp
memory/3592-28-0x0000000000400000-0x000000000056D000-memory.dmp
memory/3592-27-0x0000000000400000-0x000000000056D000-memory.dmp
memory/3592-4-0x0000000002480000-0x0000000002481000-memory.dmp
memory/4476-29-0x0000000000A80000-0x0000000000AD4000-memory.dmp
memory/4476-24-0x0000000000400000-0x000000000056D000-memory.dmp
memory/4476-23-0x0000000000A80000-0x0000000000AD4000-memory.dmp
memory/4476-30-0x0000000002600000-0x0000000002601000-memory.dmp
memory/4476-22-0x0000000000400000-0x000000000056D000-memory.dmp