Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 17:58
Behavioral task
behavioral1
Sample
de9db329b22c52090c30f9807e2b4eb9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
de9db329b22c52090c30f9807e2b4eb9.exe
Resource
win10v2004-20240226-en
General
-
Target
de9db329b22c52090c30f9807e2b4eb9.exe
-
Size
1.0MB
-
MD5
de9db329b22c52090c30f9807e2b4eb9
-
SHA1
51e9609e2e26c8eb392cc14435dcfdf8b0ee40d9
-
SHA256
6aec49c1be6e7920c03008bd324f832d46b8f51c17b4322cd8e76bef9a222c0f
-
SHA512
c7363ed4dd6362ee6df1dbb5a6c5d8e180bc21f6c132b062c0b67fc2b6b51af9b3c873faae1a14f4276543b24d342e9c71f56766e9c993ed3b7bab4a746d4ed3
-
SSDEEP
12288:tERVq31AQHW3W4KlqckjwfIVLUL7f2wx/hCzJjiLKTFp+33TW3Immr8wYbF0wp38:W3qeG4KUchcW2P0apQ3TKrox
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/1368-2-0x0000000000400000-0x0000000000518000-memory.dmp modiloader_stage2 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\2010.txt de9db329b22c52090c30f9807e2b4eb9.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1960 1368 de9db329b22c52090c30f9807e2b4eb9.exe 28 PID 1368 wrote to memory of 1960 1368 de9db329b22c52090c30f9807e2b4eb9.exe 28 PID 1368 wrote to memory of 1960 1368 de9db329b22c52090c30f9807e2b4eb9.exe 28 PID 1368 wrote to memory of 1960 1368 de9db329b22c52090c30f9807e2b4eb9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\de9db329b22c52090c30f9807e2b4eb9.exe"C:\Users\Admin\AppData\Local\Temp\de9db329b22c52090c30f9807e2b4eb9.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵PID:1960
-