Analysis
-
max time kernel
1801s -
max time network
1566s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-03-2024 13:44
General
-
Target
3d26ddb0a96c825ff98a6b6456bf52dab1a896da2a8690a041524a6c82213a05.exe
-
Size
267KB
-
MD5
6d4c037eb8ba3f50e55f5a1f0d8a59d2
-
SHA1
7a91a47cfdc65fe7463eef406c15877ee194a2a2
-
SHA256
3d26ddb0a96c825ff98a6b6456bf52dab1a896da2a8690a041524a6c82213a05
-
SHA512
1de971175cff40a906c6fb5bd6aa40007b7acb8698b5d38c858108ad2ff45be60cfa28227beabab4b70a0bff46caecb1284c1c72e23446051d6949b811073608
-
SSDEEP
6144:o603faijWMA7PaSLeVHYjsNw9ENcBegswERi1umU:2vVvaPaSLwDqMcBePwERi1s
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d26ddb0a96c825ff98a6b6456bf52dab1a896da2a8690a041524a6c82213a05.exe"C:\Users\Admin\AppData\Local\Temp\3d26ddb0a96c825ff98a6b6456bf52dab1a896da2a8690a041524a6c82213a05.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2216-0-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2216-1-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/2216-2-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2216-4-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2216-5-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2216-6-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2216-7-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2216-9-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB