Analysis Overview
score
10/10
SHA256
94f8b9967bf09665443b1c6f8a4948eda260ee0b68c0b2f646e09ed383424b66
Threat Level: Known bad
The file ae3e2ecba60ea757486c0843d6fef794e71cfcca22fa66840d5b67b608fd28f4.bin.sample.gz was found to be: Known bad.
Malicious Activity Summary
ModiLoader, DBatLoader
ModiLoader Second Stage
Unsigned PE
MITRE ATT&CK Matrix
N/A
Analysis: static1
Detonation Overview
Reported
2024-06-19 12:09
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-19 12:09
Reported
2024-06-19 12:29
Platform
win10-20240611-de
Max time kernel
1191s
Max time network
1201s
Command Line
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
Signatures
ModiLoader, DBatLoader
ModiLoader Second Stage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | tottenham02.duckdns.org | udp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 8.8.8.8:53 | 208.143.182.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 8.8.8.8:53 | 239.249.30.184.in-addr.arpa | udp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 8.8.8.8:53 | 9.144.22.2.in-addr.arpa | udp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
| US | 162.247.153.39:443 | tottenham02.duckdns.org | tcp |
Files
memory/2332-0-0x0000000002140000-0x0000000002141000-memory.dmp
memory/2332-1-0x0000000002FF0000-0x000000000301C000-memory.dmp
memory/2332-3-0x0000000002140000-0x0000000002141000-memory.dmp
memory/2332-4-0x0000000000400000-0x0000000000501000-memory.dmp