Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 18:05
Behavioral task
behavioral1
Sample
dea0439d0e715f60aef459c4f61d5e88.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dea0439d0e715f60aef459c4f61d5e88.exe
Resource
win10v2004-20240226-en
General
-
Target
dea0439d0e715f60aef459c4f61d5e88.exe
-
Size
314KB
-
MD5
dea0439d0e715f60aef459c4f61d5e88
-
SHA1
72bd346d75f39ac62a8f6f686c23fc6deebcb460
-
SHA256
e0ccb1a839e841cefc25ddce2d263068a5daa63a62cd4b830face054b738acf0
-
SHA512
1ad6e92cd8b36d3c0190ec834e3faebf15bef7d9576a82a2ab837e56ed4717120d2c8481e29ddefac261a402d6a0145fa7d49e711cea55de573832f7cdba5227
-
SSDEEP
6144:Xc7j+/DsDcRL2QlUKUp4CliJEhVfO3gzTyWDznCi/b8cB6yU0kRc0in27KATRiO0:s7j0ADcRL2QlUn4ClYEhVfO3gzTyWD75
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2212-1-0x0000000000400000-0x00000000004C8000-memory.dmp modiloader_stage2 -
resource yara_rule behavioral1/memory/2212-0-0x0000000000400000-0x00000000004C8000-memory.dmp upx behavioral1/memory/2212-1-0x0000000000400000-0x00000000004C8000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2952 2212 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2952 2212 dea0439d0e715f60aef459c4f61d5e88.exe 28 PID 2212 wrote to memory of 2952 2212 dea0439d0e715f60aef459c4f61d5e88.exe 28 PID 2212 wrote to memory of 2952 2212 dea0439d0e715f60aef459c4f61d5e88.exe 28 PID 2212 wrote to memory of 2952 2212 dea0439d0e715f60aef459c4f61d5e88.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\dea0439d0e715f60aef459c4f61d5e88.exe"C:\Users\Admin\AppData\Local\Temp\dea0439d0e715f60aef459c4f61d5e88.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 362⤵
- Program crash
PID:2952
-