Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 10:06

General

  • Target

    dee67ad2022a50c9a850345f9f3039ad.exe

  • Size

    701KB

  • MD5

    dee67ad2022a50c9a850345f9f3039ad

  • SHA1

    3e4c82e2ad7dbf797c2d1af1c41939c7147233ac

  • SHA256

    797912761cf52fc44dda12c6fa8a0027c92ab06c9c17eb63130d0b6934b7c3f9

  • SHA512

    06533c800facb33e67ecc99fad16fe7176705e7efde64c7edd0f4aa9c3c5c5c10d302989dc14cae992be23bdd5ea3e45de6048bd6658a0be8ac51abbede0e90a

  • SSDEEP

    12288:Y25vFB7a36YOZ0BHNpFhZ+ylXjDuNKTh41c2obY7N3PocPj:DxX86HMHNpF3HuNKlqochfocPj

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dee67ad2022a50c9a850345f9f3039ad.exe
    "C:\Users\Admin\AppData\Local\Temp\dee67ad2022a50c9a850345f9f3039ad.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8_LHEX~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8_LHEX~1.EXE
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Program Files\Common Files\Microsoft Shared\MSINFO\srever.exe
        "C:\Program Files\Common Files\Microsoft Shared\MSINFO\srever.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4508
        • C:\program files\internet explorer\IEXPLORE.EXE
          "C:\program files\internet explorer\IEXPLORE.EXE"
          4⤵
            PID:896
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 604
            4⤵
            • Program crash
            PID:4972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4508 -ip 4508
      1⤵
        PID:3624

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8_LHEX~1.EXE

              Filesize

              387KB

              MD5

              339c098612d9d5e191ff1ed1cf79e407

              SHA1

              4100a767a69410dc46e0cedf9271b19fd77daba5

              SHA256

              93c876b2084c1f27fd1a23e54e3199c4a180303a5648c90d234d86a3f19f8522

              SHA512

              7801e6a24a9a349293d254a3a4bffa62765cb7bf5749a4743a20854adf501acf33ef746a92fc410aad056d3398367607b142a2ab141d09517aa182670776261e

            • memory/1964-37-0x0000000000400000-0x0000000000521000-memory.dmp

              Filesize

              1.1MB

            • memory/1964-30-0x0000000002500000-0x0000000002501000-memory.dmp

              Filesize

              4KB

            • memory/1964-27-0x0000000000400000-0x0000000000521000-memory.dmp

              Filesize

              1.1MB

            • memory/1964-25-0x0000000000400000-0x0000000000521000-memory.dmp

              Filesize

              1.1MB

            • memory/1964-26-0x0000000000400000-0x0000000000521000-memory.dmp

              Filesize

              1.1MB

            • memory/2640-7-0x0000000000D10000-0x0000000000D11000-memory.dmp

              Filesize

              4KB

            • memory/2640-17-0x00000000005B0000-0x00000000005B1000-memory.dmp

              Filesize

              4KB

            • memory/2640-8-0x0000000000D50000-0x0000000000D51000-memory.dmp

              Filesize

              4KB

            • memory/2640-9-0x0000000000D20000-0x0000000000D21000-memory.dmp

              Filesize

              4KB

            • memory/2640-10-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

              Filesize

              4KB

            • memory/2640-11-0x0000000002A20000-0x0000000002A23000-memory.dmp

              Filesize

              12KB

            • memory/2640-12-0x0000000002A30000-0x0000000002A31000-memory.dmp

              Filesize

              4KB

            • memory/2640-13-0x0000000002A90000-0x0000000002A91000-memory.dmp

              Filesize

              4KB

            • memory/2640-14-0x00000000005A0000-0x00000000005A1000-memory.dmp

              Filesize

              4KB

            • memory/2640-21-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

              Filesize

              4KB

            • memory/2640-20-0x0000000002A40000-0x0000000002A41000-memory.dmp

              Filesize

              4KB

            • memory/2640-19-0x0000000002A50000-0x0000000002A51000-memory.dmp

              Filesize

              4KB

            • memory/2640-18-0x0000000002A60000-0x0000000002A61000-memory.dmp

              Filesize

              4KB

            • memory/2640-0-0x0000000001000000-0x00000000010BF000-memory.dmp

              Filesize

              764KB

            • memory/2640-6-0x0000000000D00000-0x0000000000D01000-memory.dmp

              Filesize

              4KB

            • memory/2640-5-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

              Filesize

              4KB

            • memory/2640-4-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

              Filesize

              4KB

            • memory/2640-3-0x0000000000D40000-0x0000000000D41000-memory.dmp

              Filesize

              4KB

            • memory/2640-2-0x0000000000AE0000-0x0000000000B30000-memory.dmp

              Filesize

              320KB

            • memory/2640-39-0x0000000000AE0000-0x0000000000B30000-memory.dmp

              Filesize

              320KB

            • memory/2640-38-0x0000000001000000-0x00000000010BF000-memory.dmp

              Filesize

              764KB

            • memory/2640-1-0x0000000001000000-0x00000000010BF000-memory.dmp

              Filesize

              764KB

            • memory/4508-36-0x0000000000700000-0x0000000000701000-memory.dmp

              Filesize

              4KB

            • memory/4508-35-0x0000000000400000-0x0000000000521000-memory.dmp

              Filesize

              1.1MB

            • memory/4508-40-0x0000000000400000-0x0000000000521000-memory.dmp

              Filesize

              1.1MB