Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 13:23
Behavioral task
behavioral1
Sample
MassSender.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
MassSender.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
MassSender.exe
-
Size
2.2MB
-
MD5
88f65230b988517b529f15ee1f173b3c
-
SHA1
5dd29ced644415f87d106b340eba656eb9eae311
-
SHA256
e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e
-
SHA512
46ac27d80b61939f0fef7d5493866274f95494bcfb855751d8b82d6677ef2aef1d6fc9f26b1dbeb217277abe4408ccbc3c75dfc37bc552f31085dc31e99e0c91
-
SSDEEP
49152:4n7JG9CyViR+Y9ZYVCiIrNDctSXXEeXzAAAL:yV+C0nYoItyg9AL
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3020-3-0x0000000000400000-0x000000000098F000-memory.dmp modiloader_stage1 behavioral2/memory/3020-7-0x0000000000400000-0x000000000098F000-memory.dmp modiloader_stage1 behavioral2/memory/3020-11-0x0000000000400000-0x000000000098F000-memory.dmp modiloader_stage1 behavioral2/memory/3020-13-0x0000000000400000-0x000000000098F000-memory.dmp modiloader_stage1 -
Modifies registry class 6 IoCs
Processes:
MassSender.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID MassSender.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{237561AB-1162-5837-1307-251216710420} MassSender.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info MassSender.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info\Data = 001efd760000000000000000090000009b4c0877c024a500090000002c2b3577906f3677083ea500101efd76feffff0008fa190018550577340000c000000000ccfa19002555057764fa1900000000000c0000006cfa1900000000009c0200000200000070001900000000000000000070f9190000000000646dd5a2e20b00001420120852077a7ebcf91900065c02006445df02d0f9190001000000bcf919003c00000038a5da01592801b1000000006445df02d0f9190004000000a701000004fa1900c6cd337760fa0000b0fa1900ecd58802e80705000d000d0017000600d4020100592801b138a5da019b4c087700000000000000000000000000000000000000000000000044fa1900b7e5067720fa19002cfa190060fa19009458870205e60677592801b138a5da012000fe7fe80705000d000d0017000600d4020100d4710ec4000000009cfa190051e5067760fa1900050000000d0017c4962b6900170000006445df02e80700019cfa19009e2a690094fa1900d4020000d4fa1900cc2a6900d42a690094588702ecd58802ecd5880204322e30307953b8d0d8e13f0f0000008c2f6900d402190053b8d0d853b8d0d81130e64001000d000d001700 MassSender.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info MassSender.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node MassSender.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MassSender.exepid process 3020 MassSender.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MassSender.exepid process 3020 MassSender.exe 3020 MassSender.exe 3020 MassSender.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3020-0-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/3020-1-0x0000000000F80000-0x0000000000F81000-memory.dmpFilesize
4KB
-
memory/3020-2-0x00000000046A0000-0x00000000046A1000-memory.dmpFilesize
4KB
-
memory/3020-3-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/3020-5-0x0000000000F80000-0x0000000000F81000-memory.dmpFilesize
4KB
-
memory/3020-6-0x00000000046A0000-0x00000000046A1000-memory.dmpFilesize
4KB
-
memory/3020-7-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/3020-12-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3020-11-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/3020-13-0x0000000000400000-0x000000000098F000-memory.dmpFilesize
5.6MB
-
memory/3020-15-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB