Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 22:36
Behavioral task
behavioral1
Sample
8d87a7c8a298eb166882932db5aa31da.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d87a7c8a298eb166882932db5aa31da.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
8d87a7c8a298eb166882932db5aa31da.exe
-
Size
396KB
-
MD5
8d87a7c8a298eb166882932db5aa31da
-
SHA1
22220abb70d646221ead42c672d309d83eb43c2d
-
SHA256
bedf2c97bf0263f35424435f895f1dbffe3d4156b8e6ee24939bc3e4a311e232
-
SHA512
07e47a9a6720aae35b4fabd7790d842fc942759d20888fb17f3c071b6eddfcef2b809685718764181059a210c4dc838dc34044951bbdfc6a0f169fb82570f507
-
SSDEEP
6144:7E9yDzN5oqKVsJAC328uO6s1wQW877buWxjy/qj+aA/pa:AEDJ5ofs9BuOB1wQW87XuWxM
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2336-0-0x0000000006260000-0x00000000062C8000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
pid pid_target Process procid_target 2016 2336 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2016 2336 8d87a7c8a298eb166882932db5aa31da.exe 28 PID 2336 wrote to memory of 2016 2336 8d87a7c8a298eb166882932db5aa31da.exe 28 PID 2336 wrote to memory of 2016 2336 8d87a7c8a298eb166882932db5aa31da.exe 28 PID 2336 wrote to memory of 2016 2336 8d87a7c8a298eb166882932db5aa31da.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d87a7c8a298eb166882932db5aa31da.exe"C:\Users\Admin\AppData\Local\Temp\8d87a7c8a298eb166882932db5aa31da.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1602⤵
- Program crash
PID:2016
-