Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 23:22
Static task
static1
Behavioral task
behavioral1
Sample
8da0ee226a6dee9c2e4ec4f32861a9b6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8da0ee226a6dee9c2e4ec4f32861a9b6.exe
Resource
win10v2004-20231222-en
General
-
Target
8da0ee226a6dee9c2e4ec4f32861a9b6.exe
-
Size
386KB
-
MD5
8da0ee226a6dee9c2e4ec4f32861a9b6
-
SHA1
09663c9987f809cead4be3a8cf248f6ce5f06510
-
SHA256
07c8f3fe0632fb3da33e681cd341efa05f0c2752099d2b61bb397d969deccede
-
SHA512
131cf25233fd8cc3edf80f12cf65cdfae38f6784cfe4f7eaf5385d1a87c5bbb4cd3f313c22b3e97f0c76f4357b4a17def4ed13263770191910779478e66df086
-
SSDEEP
6144:SOF2idZecnl20lHRxp3gUncduD7yB9VCO6Sco4q8+dE6CqhM8fsdS:NF3Z4mxxnDqVTVOCbsQ
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/4592-3-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 behavioral2/memory/4592-106-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 -
Loads dropped DLL 2 IoCs
pid Process 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll 8da0ee226a6dee9c2e4ec4f32861a9b6.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4592 8da0ee226a6dee9c2e4ec4f32861a9b6.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD55bcf32658f6e216b0cc18c6549d8aaf8
SHA1f408ee4d438762b34d8adbf9bbc677ae097c8cdd
SHA256375a2bf079341653b2b4937803313ae9ce53ca4c7ba5c82d7a0e77fc65c08bf0
SHA51206ead9d20489dc6424a24e508aefe9b9bd3a42014a815cafcd441f129d5d3c55abdd21f1bce9e8d060e40680d42c483e503b40c41af58d007a72f0ba94902977