Analysis
- max time kernel
25s - max time network
24s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/02/2024, 04:06
General
- Target 8e2d738acd73a7bbcc2e2dec8c36f1e1.exe
- Size 628KB
- Sample240204-ephbnahda2
- SHA256 1aa595344ad4c8d5c526bf404e0364f910326647963745b702cc5fde9c689d9e
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 3 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Program crash 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e2d738acd73a7bbcc2e2dec8c36f1e1.exe"C:\Users\Admin\AppData\Local\Temp\8e2d738acd73a7bbcc2e2dec8c36f1e1.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se51.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se51.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 124⤵
- Program crash
-
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 6883⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4928 -ip 49281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3120 -ip 31201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Se51.exe
memory/3120-45-0x0000000000400000-0x0000000000514000-memory.dmp
memory/3120-39-0x0000000003420000-0x0000000003421000-memory.dmp
memory/3120-40-0x00000000025E0000-0x00000000025E1000-memory.dmp
memory/3120-37-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3120-36-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/3120-33-0x0000000003400000-0x0000000003401000-memory.dmp
memory/3120-32-0x00000000034C0000-0x00000000034C1000-memory.dmp
memory/3120-31-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/3120-30-0x00000000021A0000-0x00000000021F4000-memory.dmp
memory/3120-29-0x0000000000400000-0x0000000000514000-memory.dmp
memory/4528-10-0x0000000002530000-0x0000000002531000-memory.dmp
memory/4528-9-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/4528-14-0x0000000003600000-0x0000000003601000-memory.dmp
memory/4528-13-0x0000000003600000-0x0000000003601000-memory.dmp
memory/4528-15-0x0000000003600000-0x0000000003601000-memory.dmp
memory/4528-16-0x00000000022C0000-0x00000000022C1000-memory.dmp
memory/4528-18-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4528-17-0x00000000022D0000-0x00000000022D1000-memory.dmp
memory/4528-19-0x0000000003530000-0x0000000003531000-memory.dmp
memory/4528-20-0x0000000003520000-0x0000000003521000-memory.dmp
memory/4528-21-0x0000000003560000-0x0000000003561000-memory.dmp
memory/4528-22-0x0000000003550000-0x0000000003551000-memory.dmp
memory/4528-23-0x0000000002720000-0x0000000002721000-memory.dmp
memory/4528-11-0x0000000003510000-0x0000000003511000-memory.dmp
memory/4528-0-0x0000000000400000-0x0000000000514000-memory.dmp
memory/4528-12-0x0000000003500000-0x0000000003503000-memory.dmp
memory/4528-8-0x0000000002570000-0x0000000002571000-memory.dmp
memory/4528-6-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4528-7-0x0000000002580000-0x0000000002581000-memory.dmp
memory/4528-4-0x0000000002590000-0x0000000002591000-memory.dmp
memory/4528-5-0x0000000002520000-0x0000000002521000-memory.dmp
memory/4528-38-0x0000000000400000-0x0000000000514000-memory.dmp
memory/4528-2-0x0000000002560000-0x0000000002561000-memory.dmp
memory/4528-3-0x0000000002540000-0x0000000002541000-memory.dmp
memory/4528-49-0x0000000002300000-0x0000000002354000-memory.dmp
memory/4528-44-0x0000000002300000-0x0000000002354000-memory.dmp
memory/4528-1-0x0000000002300000-0x0000000002354000-memory.dmp
memory/4528-48-0x0000000000400000-0x0000000000514000-memory.dmp
memory/4528-47-0x0000000003590000-0x0000000003591000-memory.dmp
memory/4928-41-0x0000000000400000-0x0000000000514000-memory.dmp