Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
20-06-2024 01:15
General
-
Target
上兴远程控制20090405破解版/rejoice.exe
-
Size
2.3MB
-
MD5
8c02e23e90378077c2cbaf9cc537f115
-
SHA1
6bf345320316a7459268be918d8d0e55b18c08a8
-
SHA256
51c9e20eb9274564303f95254896c6b3df6cc6673a5d18749a8e57cd22e0953f
-
SHA512
ef148c6bd844655ddb77864033f708ef2edc6ab0fa8ad4edbaa04d4939a4cf9d887e8c696c773a38a6b363b54f58b81b56350d31b503b2cb9f23ecf347d8998d
-
SSDEEP
49152:eJFZawJWHiuR5ZbyTyHrc//////iaTjvDQ4zc//////OX5:eJFoy+FyTyLc//////dDjzc//////45
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\上兴远程控制20090405破解版\rejoice.exe"C:\Users\Admin\AppData\Local\Temp\上兴远程控制20090405破解版\rejoice.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2020-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2020-1-0x00000000020D0000-0x00000000020D1000-memory.dmpFilesize
4KB
-
memory/2020-2-0x0000000000400000-0x0000000000670000-memory.dmpFilesize
2.4MB
-
memory/2020-4-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2020-6-0x00000000020D0000-0x00000000020D1000-memory.dmpFilesize
4KB