Analysis
-
max time kernel
36s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-06-2024 19:28
General
-
Target
c57b287858b87f3528e1366bcb4359e8.exe
-
Size
1.2MB
-
MD5
c57b287858b87f3528e1366bcb4359e8
-
SHA1
2629391b45ae9cb08c5df8dd53bdc7c7f222c171
-
SHA256
119bb4f428f6056330cf8a0087b1a52277dbceca3cd81f1d5934c4f4a398c664
-
SHA512
0100caab7532f3adeb4f6302c76dd44e2ab5ebca9dde4e39d73895d4ecda7341e825b73aa4ebeac16873be79c0352c60baec5c59508429043c9515c777202476
-
SSDEEP
24576:erGbRrkUYzzxxNv4zomYUm2MA5H8g24ZrH:eKKwomY2MA9m2H
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 62 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c57b287858b87f3528e1366bcb4359e8.exe"C:\Users\Admin\AppData\Local\Temp\c57b287858b87f3528e1366bcb4359e8.exe"1⤵
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows "2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows \System32"2⤵
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\c57b287858b87f3528e1366bcb4359e8.exe C:\\Users\\Public\\Libraries\\Uvewfldq.PIF2⤵
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\note\nots.datFilesize
144B
MD5f2cbd3bbfd79c430e5d87ac5ce3b7dc2
SHA1a0c1609cad6ee7af09ff56e32ed06a33e33d4e48
SHA256e6f10ab3a3155034c25c404460933eaebe3fe6210cc7a938fc6920d9b0d0ecb2
SHA5120173ea3c18b4284fe6f4c0eff1714c92a90a59893656e671f1c636d1d7919646e90c9fe7ed90af3f8f35d74eb5c9889b9645069bb0a3656368524da91b19404c
-
memory/4924-0-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/4924-1-0x0000000000400000-0x0000000000948000-memory.dmpFilesize
5.3MB
-
memory/4924-7-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-5-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-4-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-6-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-3-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-8-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-14-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-12-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-19-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-74-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-72-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-27-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-25-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-44-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-41-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-15-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-26-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-17-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-18-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-23-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-16-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-13-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-11-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-10-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-9-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-29-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-46-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-45-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-40-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-38-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-37-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-36-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-35-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-33-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-32-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-31-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-30-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-76-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-75-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-71-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-28-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-70-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-69-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-68-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-66-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-67-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-65-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-64-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-63-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-62-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-58-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-56-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-24-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-51-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-49-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-43-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-20-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-42-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-22-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-39-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-21-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-34-0x0000000002E70000-0x0000000003E70000-memory.dmpFilesize
16.0MB
-
memory/4924-424-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB