Analysis
-
max time kernel
145s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 12:02
Behavioral task
behavioral1
Sample
6afe694ee7ee20233a963cd860d94380_NEAS.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6afe694ee7ee20233a963cd860d94380_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
6afe694ee7ee20233a963cd860d94380_NEAS.exe
-
Size
36KB
-
MD5
6afe694ee7ee20233a963cd860d94380
-
SHA1
34ae16e60f84427f2584b3321babd1d49736219f
-
SHA256
621322496cf7c294661b3d7ebaba7c91195eef519fdb506810209f7ef5793d5d
-
SHA512
da9270f0ddfff153b97cb59ae8186c7aeff21731c91281b0376d0cc123a8bcbffa821b723da5217dcbfd6a22bf729cc624e8d4719a7b4fd8b10a28792871b1d5
-
SSDEEP
768:jycqOQ0bwMK2M3fQde8Pfymg0M9EQfRo0ys/KzD:WcqOQbB3fQc8Pfymg0yxpByxzD
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2392-0-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2