Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 13:21
Behavioral task
behavioral1
Sample
MassSender.exe
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
MassSender.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
MassSender.exe
-
Size
2.2MB
-
MD5
88f65230b988517b529f15ee1f173b3c
-
SHA1
5dd29ced644415f87d106b340eba656eb9eae311
-
SHA256
e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e
-
SHA512
46ac27d80b61939f0fef7d5493866274f95494bcfb855751d8b82d6677ef2aef1d6fc9f26b1dbeb217277abe4408ccbc3c75dfc37bc552f31085dc31e99e0c91
-
SSDEEP
49152:4n7JG9CyViR+Y9ZYVCiIrNDctSXXEeXzAAAL:yV+C0nYoItyg9AL
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1576-3-0x0000000000400000-0x000000000098F000-memory.dmp modiloader_stage1 behavioral1/memory/1576-7-0x0000000000400000-0x000000000098F000-memory.dmp modiloader_stage1 behavioral1/memory/1576-9-0x0000000000400000-0x000000000098F000-memory.dmp modiloader_stage1 behavioral1/memory/1576-11-0x0000000000400000-0x000000000098F000-memory.dmp modiloader_stage1 behavioral1/memory/1576-13-0x0000000000400000-0x000000000098F000-memory.dmp modiloader_stage1 -
Modifies registry class 6 IoCs
Processes:
MassSender.exedescription ioc process Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info MassSender.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node MassSender.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID MassSender.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420} MassSender.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info MassSender.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info\Data = 0062847724628477b0c2ff7858fa180098fa82778cf918001cf91800aafa827798fa1800cd1e88775cf5640ffeffffff24628477fc1eef75340000c00d09cf76e4fa1800091fef752001000080fa180088fa18006ce3837784fa180002000000000000000000000020010000000000008cf91800340000c05801310000000000b02e310000000000080018086e00740088393100000000005c00520045004700490053005400520059005c004d004100000000000000af000843b40053006f006600740025000e00020000005c0043004c00410053005300a842b400010000000043b40010fa180003e08377e4fa180058fa1800000000000043b40024fa180088e683770000af00000000000843b40034fa180007f6d3a2e20b000014201208c4e3787e60fa18000005877707f6d3a2260c00000eb967faeb50d7c61a00000000000000000000009cfa18000000000080fa1800050000000d000000962b69001500000007cedd02e8071801b4fa18009e2a6900acfa180077020000ecfa1800cc2a6900d42a6900fc55990058d49a0058d49a0004322e303068354bb4cfe13f0f0000008c2f690077021800354bb4cf354bb4cf1130e64001000d000d001500 MassSender.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MassSender.exepid process 1576 MassSender.exe 1576 MassSender.exe 1576 MassSender.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1576-0-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/1576-1-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1576-2-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/1576-3-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/1576-5-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1576-6-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/1576-7-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/1576-9-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/1576-11-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/1576-12-0x0000000003B00000-0x0000000003B01000-memory.dmpFilesize
4KB
-
memory/1576-13-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/1576-15-0x0000000003B00000-0x0000000003B01000-memory.dmpFilesize
4KB