Analysis

  • max time kernel
    128s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2024 01:13

General

  • Target

    DHL STATEMENT OF ACCOUNT e COPY 0087965677555.exe

  • Size

    881KB

  • MD5

    c6371a959e9e74c78719e2bdd259b9c2

  • SHA1

    6eb6fbe3541085ac113a160d6fabfd0990303dcb

  • SHA256

    bb06b854327139dfb8b3ecacff60c3dc13dc485ee74eba0e71afe575299fc252

  • SHA512

    e63889469acbc68d75eed22c57a112eb1bfbbe0113bccdb65bd827023ba6aa071d417e033304faa7785af4c4508c14d516a0b70c2146234ec4b56686c258918b

  • SSDEEP

    12288:dZREX+Lzw1fVVPvIWbYzpcVp5csRbSA6E7xvWVL+doDfO7Q3:dnZw1tBjdp5c2bSO9vWVqQs0

Score
10/10

Malware Config

Extracted

Family

modiloader

C2

https://cdn.discordapp.com/attachments/753549570230976536/755660991227887657/Qapjayi

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader First Stage 1 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL STATEMENT OF ACCOUNT e COPY 0087965677555.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL STATEMENT OF ACCOUNT e COPY 0087965677555.exe"
    1⤵
      PID:808
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 1652
        2⤵
        • Program crash
        PID:3656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 808 -ip 808
      1⤵
        PID:1464

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/808-0-0x00000000005D0000-0x00000000005D1000-memory.dmp

        Filesize

        4KB

      • memory/808-1-0x0000000000400000-0x00000000004E1000-memory.dmp

        Filesize

        900KB

      • memory/808-3-0x00000000022C0000-0x00000000022FA000-memory.dmp

        Filesize

        232KB

      • memory/808-9-0x0000000000400000-0x00000000004E1000-memory.dmp

        Filesize

        900KB

      • memory/808-10-0x00000000005D0000-0x00000000005D1000-memory.dmp

        Filesize

        4KB