Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 16:37
Behavioral task
behavioral1
Sample
de74e1eb8ca5494496632da478851ade.exe
Resource
win7-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
de74e1eb8ca5494496632da478851ade.exe
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
-
Target
de74e1eb8ca5494496632da478851ade.exe
-
Size
396KB
-
MD5
de74e1eb8ca5494496632da478851ade
-
SHA1
99f22f4fa9a0619b9f09e15afc6446160ae6541e
-
SHA256
a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240
-
SHA512
3f4daf1ed4e877b8afc746784ce697beea7cdd19b220b7a8535ba378906ebd7d9bd7c0ecdc11a7e952e050ffc31b7fa9cced324b33a45a8df682dd2f7f0519d2
-
SSDEEP
6144:JE9yDzN5oqKVsJAC328uO6s1wQW877buWxjy/qj+aA/H4:+EDJ5ofs9BuOB1wQW87XuWxM
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2828-0-0x00000000064C0000-0x0000000006528000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
pid pid_target Process procid_target 2660 2828 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2660 2828 de74e1eb8ca5494496632da478851ade.exe 28 PID 2828 wrote to memory of 2660 2828 de74e1eb8ca5494496632da478851ade.exe 28 PID 2828 wrote to memory of 2660 2828 de74e1eb8ca5494496632da478851ade.exe 28 PID 2828 wrote to memory of 2660 2828 de74e1eb8ca5494496632da478851ade.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\de74e1eb8ca5494496632da478851ade.exe"C:\Users\Admin\AppData\Local\Temp\de74e1eb8ca5494496632da478851ade.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 1602⤵
- Program crash
PID:2660
-