Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-04-2024 20:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
1.4MB
-
MD5
86c87988e4c163f7b19bd68555c9d019
-
SHA1
5279f39755dc24f3044299d6ecd64ac63ec73ca7
-
SHA256
1fecd8f9260d65863bd4ec9e8818b618ee01c741316dc20234bd715d0940eb22
-
SHA512
255dc520135189363dfb7505e71dc4f98806d74714d8f82755379ab91bfb1ccdfa89605cc26820bd5d9b50bf1ddc83a44d2ac770b6a0f724d7ce19b604ddb9b8
-
SSDEEP
24576:/6iXI/6AsGqohuP2v8rT3rM9qTgtAxMXYu9jz+ghCnCP6Zwras/:i8bTrM9IoS0jz+gwnAj
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2136-2-0x0000000003220000-0x0000000004220000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3064 2136 WerFault.exe tmp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
tmp.exedescription pid process target process PID 2136 wrote to memory of 3064 2136 tmp.exe WerFault.exe PID 2136 wrote to memory of 3064 2136 tmp.exe WerFault.exe PID 2136 wrote to memory of 3064 2136 tmp.exe WerFault.exe PID 2136 wrote to memory of 3064 2136 tmp.exe WerFault.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2136-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2136-1-0x0000000003220000-0x0000000004220000-memory.dmpFilesize
16.0MB
-
memory/2136-2-0x0000000003220000-0x0000000004220000-memory.dmpFilesize
16.0MB
-
memory/2136-4-0x0000000000400000-0x0000000000573000-memory.dmpFilesize
1.4MB