Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-03-2024 17:03
General
-
Target
c1212655df4831d962d3f0de5baabd98.exe
-
Size
76KB
-
MD5
c1212655df4831d962d3f0de5baabd98
-
SHA1
1e83ca9cef36548ff9ab1e711082cbb4cb168c3d
-
SHA256
4f3363a149b67ddb2d0ed6d55e38a3d17f4bbdb6d16962f5b04f94283e4b2748
-
SHA512
e5ee9c0c2a8ca9a72a6ce61ea01d5ca613595b161fe4af97215ac1a7c3c8c11bb975577c4a728211c3cbbc48f180e602070dd18b372797fd88156fa591b238a1
-
SSDEEP
1536:3Fx7oY/Ym1mx42PUSE+D2WOuTQBtwjzliYTS7idoEMjH5nouy8y:1po+1Y55JOuatwPliYTsMotpouty
Score
10/10
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
ftp.8tt.org - Port:
21 - Username:
yanghack - Password:
0070000
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 14 IoCs
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1212655df4831d962d3f0de5baabd98.exe"C:\Users\Admin\AppData\Local\Temp\c1212655df4831d962d3f0de5baabd98.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB