Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 05:26
Behavioral task
behavioral1
Sample
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe
Resource
win10v2004-20240426-en
General
-
Target
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe
-
Size
43KB
-
MD5
73192906b5554291d79b9602e6f07321
-
SHA1
ac7322f341fbd6765384656dea3bbdcf8a398811
-
SHA256
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4
-
SHA512
9f9d518de351c23fff6c6404a96965d2cd7ef948a5d357206df427b865d142e552f09add863ea3acea65b6eed96473a2f1cb612e503648af4b89a305c762a75b
-
SSDEEP
768:XxXExy1Acg8udRyVYEC7MPWUANyEgAH0t4o1u7SXjxq11jF+Sh:XZ5Acg1Rn7MPWTzrHmVrm1w4
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1648-15-0x0000000000400000-0x000000000040A000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exepid process 1864 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe -
Loads dropped DLL 6 IoCs
Processes:
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exeWerFault.exepid process 1648 edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe 1648 edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2128 1864 WerFault.exe ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exeÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exedescription pid process target process PID 1648 wrote to memory of 1864 1648 edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe PID 1648 wrote to memory of 1864 1648 edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe PID 1648 wrote to memory of 1864 1648 edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe PID 1648 wrote to memory of 1864 1648 edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe PID 1864 wrote to memory of 2128 1864 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe WerFault.exe PID 1864 wrote to memory of 2128 1864 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe WerFault.exe PID 1864 wrote to memory of 2128 1864 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe WerFault.exe PID 1864 wrote to memory of 2128 1864 ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe"C:\Users\Admin\AppData\Local\Temp\edabb8429beb496968c3b4242e858229a029e70f605e1463981fecf18bfc9dd4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe"C:\Users\Admin\AppData\Local\Temp\ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 363⤵
- Loads dropped DLL
- Program crash
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\ÊÔÝíÑ ÈÑäÇãÌ äÝÓå.exeFilesize
28KB
MD5100b2759aac1adc7f4ddbb2476453943
SHA1f462185fa4b97b821f51b031fd16ad1855bdbfe9
SHA256fb03a8557b3efe097d9db4262014b2704c323859a6c15d6ce6731c84e03a7833
SHA512920b0149e65aaa91911a2685b2d2c069c6388d91c1b0cfc9da7534547d25863b8fc0404e927401b6a3516af8cdc578c7fdc248c6e2f05a3bb4f841d5e265f73e
-
memory/1648-7-0x00000000020A0000-0x00000000020A9000-memory.dmpFilesize
36KB
-
memory/1648-15-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1648-16-0x00000000020A0000-0x00000000020A9000-memory.dmpFilesize
36KB
-
memory/1864-17-0x0000000000400000-0x00000000004083A0-memory.dmpFilesize
32KB