Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 21:37
Behavioral task
behavioral1
Sample
621322496cf7c294661b3d7ebaba7c91195eef519fdb506810209f7ef5793d5d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
621322496cf7c294661b3d7ebaba7c91195eef519fdb506810209f7ef5793d5d.exe
Resource
win10v2004-20240426-en
General
-
Target
621322496cf7c294661b3d7ebaba7c91195eef519fdb506810209f7ef5793d5d.exe
-
Size
36KB
-
MD5
6afe694ee7ee20233a963cd860d94380
-
SHA1
34ae16e60f84427f2584b3321babd1d49736219f
-
SHA256
621322496cf7c294661b3d7ebaba7c91195eef519fdb506810209f7ef5793d5d
-
SHA512
da9270f0ddfff153b97cb59ae8186c7aeff21731c91281b0376d0cc123a8bcbffa821b723da5217dcbfd6a22bf729cc624e8d4719a7b4fd8b10a28792871b1d5
-
SSDEEP
768:jycqOQ0bwMK2M3fQde8Pfymg0M9EQfRo0ys/KzD:WcqOQbB3fQc8Pfymg0yxpByxzD
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4616-0-0x0000000000400000-0x0000000000411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4616-0-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2