Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/03/2024, 09:47
General
-
Target
e16091cdd22110a7380abfdd07a21a60.exe
-
Size
729KB
-
MD5
e16091cdd22110a7380abfdd07a21a60
-
SHA1
1861a01b76d2826b099c8f14bb948bd27674c67f
-
SHA256
e21954aafd42bbb51bd7d5d98563f3115b24b8b254cb721b1c676ec4c3b89b5f
-
SHA512
751f998f62a743ca02ce575c99ed5b8ebb15fe5cb1c0468dfbe310511e08b141e869b456cf1f2617b55594e30a97831345139969b10a648328df3833c2055905
-
SSDEEP
12288:Hmmo7YNQzGnBaWnBsPDqWOFqetuiaSwXb0lvIfU+5wOAjIXIYh:GvwQyBaWnBCqyaaNCM2OAjEIk
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 18 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e16091cdd22110a7380abfdd07a21a60.exe"C:\Users\Admin\AppData\Local\Temp\e16091cdd22110a7380abfdd07a21a60.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e16091cdd22110a7380abfdd07a21a60.exeC:\Users\Admin\AppData\Local\Temp\e16091cdd22110a7380abfdd07a21a60.exe2⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD51f213500e67fe5dfd5b1b548a148f4b2
SHA180404c1313d61533b1929f16f9459f874069da3d
SHA2566529582eabb725a3f01396c200a026071a02d06d98d7d11c5ffd5f427039acd7
SHA5127956c264ef9a0c0b11ef7cb8f5a5b21730b3aafa915a7140b39c92e1bdd289412ad0850844f4671e79cbf23cd3f2cf2d19ad5676a093deac4a557afc4387e66d
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
960KB
-
Filesize
80KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
960KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB