Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2024, 10:06

General

  • Target

    dee67ad2022a50c9a850345f9f3039ad.exe

  • Size

    701KB

  • MD5

    dee67ad2022a50c9a850345f9f3039ad

  • SHA1

    3e4c82e2ad7dbf797c2d1af1c41939c7147233ac

  • SHA256

    797912761cf52fc44dda12c6fa8a0027c92ab06c9c17eb63130d0b6934b7c3f9

  • SHA512

    06533c800facb33e67ecc99fad16fe7176705e7efde64c7edd0f4aa9c3c5c5c10d302989dc14cae992be23bdd5ea3e45de6048bd6658a0be8ac51abbede0e90a

  • SSDEEP

    12288:Y25vFB7a36YOZ0BHNpFhZ+ylXjDuNKTh41c2obY7N3PocPj:DxX86HMHNpF3HuNKlqochfocPj

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dee67ad2022a50c9a850345f9f3039ad.exe
    "C:\Users\Admin\AppData\Local\Temp\dee67ad2022a50c9a850345f9f3039ad.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8_LHEX~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8_LHEX~1.EXE
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2240
      • C:\Program Files\Common Files\Microsoft Shared\MSINFO\srever.exe
        "C:\Program Files\Common Files\Microsoft Shared\MSINFO\srever.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 292
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2664

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\8_LHEX~1.EXE

          Filesize

          387KB

          MD5

          339c098612d9d5e191ff1ed1cf79e407

          SHA1

          4100a767a69410dc46e0cedf9271b19fd77daba5

          SHA256

          93c876b2084c1f27fd1a23e54e3199c4a180303a5648c90d234d86a3f19f8522

          SHA512

          7801e6a24a9a349293d254a3a4bffa62765cb7bf5749a4743a20854adf501acf33ef746a92fc410aad056d3398367607b142a2ab141d09517aa182670776261e

        • memory/1376-14-0x0000000000160000-0x0000000000161000-memory.dmp

          Filesize

          4KB

        • memory/1376-12-0x0000000002A40000-0x0000000002A41000-memory.dmp

          Filesize

          4KB

        • memory/1376-11-0x00000000029D0000-0x00000000029D1000-memory.dmp

          Filesize

          4KB

        • memory/1376-10-0x00000000029C0000-0x00000000029C3000-memory.dmp

          Filesize

          12KB

        • memory/1376-9-0x0000000000570000-0x0000000000571000-memory.dmp

          Filesize

          4KB

        • memory/1376-8-0x00000000009C0000-0x00000000009C1000-memory.dmp

          Filesize

          4KB

        • memory/1376-7-0x00000000009F0000-0x00000000009F1000-memory.dmp

          Filesize

          4KB

        • memory/1376-6-0x0000000000890000-0x0000000000891000-memory.dmp

          Filesize

          4KB

        • memory/1376-5-0x0000000000880000-0x0000000000881000-memory.dmp

          Filesize

          4KB

        • memory/1376-4-0x0000000000550000-0x0000000000551000-memory.dmp

          Filesize

          4KB

        • memory/1376-2-0x00000000009E0000-0x00000000009E1000-memory.dmp

          Filesize

          4KB

        • memory/1376-18-0x00000000029E0000-0x00000000029E1000-memory.dmp

          Filesize

          4KB

        • memory/1376-17-0x00000000029F0000-0x00000000029F1000-memory.dmp

          Filesize

          4KB

        • memory/1376-16-0x0000000002A00000-0x0000000002A01000-memory.dmp

          Filesize

          4KB

        • memory/1376-15-0x0000000000170000-0x0000000000171000-memory.dmp

          Filesize

          4KB

        • memory/1376-0-0x0000000001000000-0x00000000010BF000-memory.dmp

          Filesize

          764KB

        • memory/1376-3-0x0000000000560000-0x0000000000561000-memory.dmp

          Filesize

          4KB

        • memory/1376-1-0x0000000000720000-0x0000000000770000-memory.dmp

          Filesize

          320KB

        • memory/1376-13-0x0000000002A30000-0x0000000002A31000-memory.dmp

          Filesize

          4KB

        • memory/1376-27-0x0000000002CF0000-0x0000000002E11000-memory.dmp

          Filesize

          1.1MB

        • memory/1376-30-0x0000000002CF0000-0x0000000002E11000-memory.dmp

          Filesize

          1.1MB

        • memory/1376-57-0x0000000001000000-0x00000000010BF000-memory.dmp

          Filesize

          764KB

        • memory/1376-58-0x0000000000720000-0x0000000000770000-memory.dmp

          Filesize

          320KB

        • memory/1376-45-0x0000000000720000-0x0000000000770000-memory.dmp

          Filesize

          320KB

        • memory/1376-42-0x0000000001000000-0x00000000010BF000-memory.dmp

          Filesize

          764KB

        • memory/2240-32-0x00000000001D0000-0x00000000001D1000-memory.dmp

          Filesize

          4KB

        • memory/2240-51-0x0000000000400000-0x0000000000521000-memory.dmp

          Filesize

          1.1MB

        • memory/2240-56-0x0000000000400000-0x0000000000521000-memory.dmp

          Filesize

          1.1MB

        • memory/2240-31-0x0000000000400000-0x0000000000521000-memory.dmp

          Filesize

          1.1MB

        • memory/2240-29-0x0000000000400000-0x0000000000521000-memory.dmp

          Filesize

          1.1MB

        • memory/2536-46-0x0000000000400000-0x0000000000521000-memory.dmp

          Filesize

          1.1MB

        • memory/2536-47-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2536-53-0x0000000000400000-0x0000000000521000-memory.dmp

          Filesize

          1.1MB