Analysis
-
max time kernel
131s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21-02-2024 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PO12017.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO12017.exe
Resource
win10v2004-20240220-en
16 signatures
150 seconds
General
-
Target
PO12017.exe
-
Size
2.2MB
-
MD5
cdd45a122734f4f14ae8c4741cd79eab
-
SHA1
97c84316d2a17e3deae6c134076f873d60cd8ce4
-
SHA256
ca5fa091df6519461da15755e36a4d4ed795581388db81b9f834d20700eeaaeb
-
SHA512
bed5c5d5916e49c0de6fd33a395f583ef72d40c91079ad1de349d68c20a1e6ab6403633b5efdeb02a454a59ebf7558e63a5d809d963c37d3230387524fb282fa
-
SSDEEP
49152:US8kak8/G2ejlDcpoaPGum5Z8MwtE5d8qdoFZ:UUak88cpogPmUCsJZ
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/1020-2-0x0000000003730000-0x0000000004730000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
pid pid_target Process procid_target 2304 1020 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1020 wrote to memory of 2304 1020 PO12017.exe 28 PID 1020 wrote to memory of 2304 1020 PO12017.exe 28 PID 1020 wrote to memory of 2304 1020 PO12017.exe 28 PID 1020 wrote to memory of 2304 1020 PO12017.exe 28