Analysis

  • max time kernel
    130s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-03-2024 12:31

General

  • Target

    Document.exe

  • Size

    1.2MB

  • MD5

    e652224389478e9294591e8bf638f9a6

  • SHA1

    33126d714dbcba65b9006472be89092cb54fa826

  • SHA256

    88c21447120abe15f0da3d0ce1dfa63e1c5e4ef52415ed177728cd229507eb83

  • SHA512

    e7e835cfa4e8aba53a1271ef849b9f3c22fe2339089f4624e42cafae014853d41d690437af21aed42477cbd432aa8229d05a20468b68e5286661e6433802756c

  • SSDEEP

    24576:LI7PgJ/Of9JIIB1jf2kH2E4NGGtPlq09Vb2aBPqK5WDpiCEKfF2V2CKKKKKKKKK5:LdJPK2kH2h3t0qVb2aBPqK5WDpifAlC4

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Program crash 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\Document.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 712
      2⤵
      • Program crash
      PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\Local\Temp\Tar8878.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

  • memory/2960-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2960-1-0x0000000002F40000-0x0000000003F40000-memory.dmp

    Filesize

    16.0MB

  • memory/2960-2-0x0000000002F40000-0x0000000003F40000-memory.dmp

    Filesize

    16.0MB

  • memory/2960-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2960-5-0x0000000000400000-0x000000000053C000-memory.dmp

    Filesize

    1.2MB