Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
debf029458a4c03ed583143bca2d70bb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
debf029458a4c03ed583143bca2d70bb.exe
Resource
win10v2004-20240226-en
General
-
Target
debf029458a4c03ed583143bca2d70bb.exe
-
Size
40KB
-
MD5
debf029458a4c03ed583143bca2d70bb
-
SHA1
de12c38b439c02e392f7f2ff87ee2c10d03e68a6
-
SHA256
ed7c819be94cc59789b80d4a002d364f897b9e42695d2b98c93d1c2c7e3085a0
-
SHA512
f98d1a965719611dfa3115aa9b69607d2eb505ee40c8d7b7c6e8b1943cc17d51bf9a6faf24cde185c5d2250221e97ca9a0f056946377be14794f6efc471316cf
-
SSDEEP
768:oufmjBuk785oPKlwQNyyuoIi6iyao32eQh+T+c2ksFmkW3kiN:oU+BxIB3Myufi+aw2Jyh2zwb
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral1/memory/1984-0-0x0000000000400000-0x000000000040FF4C-memory.dmp modiloader_stage2 behavioral1/memory/1984-2-0x0000000000220000-0x0000000000230000-memory.dmp modiloader_stage2 behavioral1/memory/1984-13-0x0000000000400000-0x000000000040FF4C-memory.dmp modiloader_stage2 behavioral1/memory/1984-20-0x0000000000220000-0x0000000000230000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1984 set thread context of 1296 1984 debf029458a4c03ed583143bca2d70bb.exe 28 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1296 1984 debf029458a4c03ed583143bca2d70bb.exe 28 PID 1984 wrote to memory of 1296 1984 debf029458a4c03ed583143bca2d70bb.exe 28 PID 1984 wrote to memory of 1296 1984 debf029458a4c03ed583143bca2d70bb.exe 28 PID 1984 wrote to memory of 1296 1984 debf029458a4c03ed583143bca2d70bb.exe 28 PID 1984 wrote to memory of 1296 1984 debf029458a4c03ed583143bca2d70bb.exe 28 PID 1984 wrote to memory of 1296 1984 debf029458a4c03ed583143bca2d70bb.exe 28 PID 1984 wrote to memory of 1296 1984 debf029458a4c03ed583143bca2d70bb.exe 28 PID 1984 wrote to memory of 1296 1984 debf029458a4c03ed583143bca2d70bb.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\debf029458a4c03ed583143bca2d70bb.exe"C:\Users\Admin\AppData\Local\Temp\debf029458a4c03ed583143bca2d70bb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\debf029458a4c03ed583143bca2d70bb.exe"C:\Users\Admin\AppData\Local\Temp\debf029458a4c03ed583143bca2d70bb.exe"2⤵PID:1296
-