Analysis
- max time kernel
151s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
25/04/2024, 01:48
General
- Target 9eef226fdb7d6c554cd552fc3f597ebfd6d77e33b95db53f7a631a75acf0c270.exe
- Size 1.6MB
- Sample240425-b8ehbsdb44
- SHA256 9eef226fdb7d6c554cd552fc3f597ebfd6d77e33b95db53f7a631a75acf0c270
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eef226fdb7d6c554cd552fc3f597ebfd6d77e33b95db53f7a631a75acf0c270.exe"C:\Users\Admin\AppData\Local\Temp\9eef226fdb7d6c554cd552fc3f597ebfd6d77e33b95db53f7a631a75acf0c270.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4028-0-0x0000000000B90000-0x0000000000B91000-memory.dmp
memory/4028-1-0x0000000002980000-0x0000000003980000-memory.dmp
memory/4028-2-0x0000000002980000-0x0000000003980000-memory.dmp
memory/4028-4-0x0000000000400000-0x000000000059C000-memory.dmp
memory/4028-6-0x0000000000B90000-0x0000000000B91000-memory.dmp