Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
8d049e05cbfa3edea467e0612ff157a0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8d049e05cbfa3edea467e0612ff157a0.exe
Resource
win10v2004-20231215-en
General
-
Target
8d049e05cbfa3edea467e0612ff157a0.exe
-
Size
305KB
-
MD5
8d049e05cbfa3edea467e0612ff157a0
-
SHA1
777d99db19aed53760dd190497f5468eb8f79da1
-
SHA256
bac1e7a449c7cc1c55e271229d0a127e783ca811dafe797106053ce8d81c79db
-
SHA512
524243b8477563fe0ec43b1f29cc0cfe3eeb160d1537d145e33cfb362b08c364a275a371a5f8526f9f94e8a042971f7a5a47b94b3877d59d7618f317513310cc
-
SSDEEP
6144:Na0cpYqEKpmwKLW9mA73b2wHtzLEU9fTYhg:zbqEKpBKezptzLzfTug
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral1/memory/2880-13-0x0000000000400000-0x0000000000553210-memory.dmp modiloader_stage2 behavioral1/memory/3044-18-0x0000000000400000-0x0000000000553210-memory.dmp modiloader_stage2 behavioral1/memory/2880-19-0x0000000000400000-0x0000000000553210-memory.dmp modiloader_stage2 behavioral1/memory/3044-27-0x0000000000400000-0x0000000000553210-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2628 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2880 explorer.bat -
Loads dropped DLL 4 IoCs
pid Process 3044 8d049e05cbfa3edea467e0612ff157a0.exe 3044 8d049e05cbfa3edea467e0612ff157a0.exe 1684 WerFault.exe 1684 WerFault.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\explorer.bat 8d049e05cbfa3edea467e0612ff157a0.exe File opened for modification C:\Program Files\explorer.bat 8d049e05cbfa3edea467e0612ff157a0.exe File created C:\Program Files\SxDel.bat 8d049e05cbfa3edea467e0612ff157a0.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1684 2880 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2880 3044 8d049e05cbfa3edea467e0612ff157a0.exe 28 PID 3044 wrote to memory of 2880 3044 8d049e05cbfa3edea467e0612ff157a0.exe 28 PID 3044 wrote to memory of 2880 3044 8d049e05cbfa3edea467e0612ff157a0.exe 28 PID 3044 wrote to memory of 2880 3044 8d049e05cbfa3edea467e0612ff157a0.exe 28 PID 2880 wrote to memory of 1684 2880 explorer.bat 29 PID 2880 wrote to memory of 1684 2880 explorer.bat 29 PID 2880 wrote to memory of 1684 2880 explorer.bat 29 PID 2880 wrote to memory of 1684 2880 explorer.bat 29 PID 3044 wrote to memory of 2628 3044 8d049e05cbfa3edea467e0612ff157a0.exe 30 PID 3044 wrote to memory of 2628 3044 8d049e05cbfa3edea467e0612ff157a0.exe 30 PID 3044 wrote to memory of 2628 3044 8d049e05cbfa3edea467e0612ff157a0.exe 30 PID 3044 wrote to memory of 2628 3044 8d049e05cbfa3edea467e0612ff157a0.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d049e05cbfa3edea467e0612ff157a0.exe"C:\Users\Admin\AppData\Local\Temp\8d049e05cbfa3edea467e0612ff157a0.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files\explorer.bat"C:\Program Files\explorer.bat"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 2843⤵
- Loads dropped DLL
- Program crash
PID:1684
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\SxDel.bat""2⤵
- Deletes itself
PID:2628
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD58f4505e5ddd5c6c6582f1dce7e5a423b
SHA12f66629e8890db1d3bfb9bbad813068cbb961a70
SHA25664209765a71b7d7f2bce86cd5b0c9888676cc5b2e3ab42f079679ba8109f19c3
SHA51298b4202d7c650dbb2c73cd2b81d7dea441bbaefe8d52ff6c78bb0b3b30f9146a812155edeb02b9605a02ad9a4a58421784f2c285a013a6546a36e3eb4d4bfd02
-
Filesize
305KB
MD58d049e05cbfa3edea467e0612ff157a0
SHA1777d99db19aed53760dd190497f5468eb8f79da1
SHA256bac1e7a449c7cc1c55e271229d0a127e783ca811dafe797106053ce8d81c79db
SHA512524243b8477563fe0ec43b1f29cc0cfe3eeb160d1537d145e33cfb362b08c364a275a371a5f8526f9f94e8a042971f7a5a47b94b3877d59d7618f317513310cc