Overview
overview
10Static
static
100715240d1a...ce.exe
windows7-x64
907fec2205c...42.exe
windows7-x64
1010dc6e128c...c0.exe
windows7-x64
3133bf8be0c...de.exe
windows7-x64
10139a8bb2c5...c1.exe
windows7-x64
1019f7d53c4a...a0.exe
windows7-x64
102896b38ec3...9c.exe
windows7-x64
102d301697ff...f4.exe
windows7-x64
3337576503...d8.exe
windows7-x64
33e04fe9f42...f1.exe
windows7-x64
103e6fbc358e...45.exe
windows7-x64
103f7458e658...df.exe
windows7-x64
434ea9832e...27.exe
windows7-x64
1047792144c9...6f.exe
windows7-x64
105114aae6e8...8c.exe
windows7-x64
10537a2fd4d2...ba.exe
windows7-x64
355754358dd...1c.exe
windows7-x64
15b1caa9bec...c1.exe
windows7-x64
160c24a4c6b...21.exe
windows7-x64
963396a28b7...cc.exe
windows7-x64
978d4fce0c2...2e.exe
windows7-x64
37c27b9fef6...33.exe
windows7-x64
381689f1be9...ed.exe
windows7-x64
10995a91e668...55.exe
windows7-x64
109d90421b2e...56.exe
windows7-x64
10a597d34bc2...40.exe
windows7-x64
10a5e6df754a...d1.exe
windows7-x64
10add2850732...6b.exe
windows7-x64
10b098486c49...0d.exe
windows7-x64
10b923f1d2ec...ed.exe
windows7-x64
10bbdac308d2...4b.exe
windows7-x64
9c3fb821138...c1.exe
windows7-x64
9Analysis
-
max time kernel
1792s -
max time network
1562s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
0715240d1af82c1cea262cde2a286b8b400805dc1f35f49422c7ee39e00f93ce.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
07fec2205cbbf2900ede2f6a1d9a5c428ef314c1dda559c632833a9c1d121542.exe
Resource
win7-20240705-en
Behavioral task
behavioral3
Sample
10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
133bf8be0cf7003b83b03579970997d408a930e58ec2726715140520900c06de.exe
Resource
win7-20240708-en
Behavioral task
behavioral5
Sample
139a8bb2c5537190e747d2f651b423147018fd9a9a21bb36281d4ce1c61727c1.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe
Resource
win7-20240704-en
Behavioral task
behavioral7
Sample
2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
2d301697ff72986171c0b2ccc979ab8e93671d640de6abad57de7d4e146b70f4.exe
Resource
win7-20240708-en
Behavioral task
behavioral9
Sample
3337576503c3e2d8876f50191ae8995b04a4536f816025c543d0e20250598fd8.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe
Resource
win7-20240705-en
Behavioral task
behavioral11
Sample
3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
3f7458e658401c15b675db78a2e9871ca3eeff3c6e299c4545515e56b66466df.exe
Resource
win7-20240704-en
Behavioral task
behavioral13
Sample
434ea9832e6d11d614905e3eb31c333289429095b76573f1ceb38fd10608bc27.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
47792144c9b440b3d2fbd422f68a23a8a8dfc16466d2a7430fc283a9d382826f.exe
Resource
win7-20240704-en
Behavioral task
behavioral15
Sample
5114aae6e86c7eedfbf181110e4fddfad88fe296ec590390705e00272121e48c.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
537a2fd4d214a212df06fb73b19ba945672eaf18d64cc30d8e99ab6a0d7cb9ba.exe
Resource
win7-20240705-en
Behavioral task
behavioral17
Sample
55754358ddd26b3c56ca27780dcc408711f8a9fc42b1c9d305d1045146f40f1c.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
5b1caa9bec8d7d7833b0e25f3e4256975c38a22c2901f8e4d99fb164dfde13c1.exe
Resource
win7-20240705-en
Behavioral task
behavioral19
Sample
60c24a4c6b54b1f4baeaee585e5e2486bbd3ab4733de36bb28da1fdb20596e21.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
63396a28b79a7eaa60c384bcb02699398cd3b2b0c14fe9cfaf52b2ffa57798cc.exe
Resource
win7-20240705-en
Behavioral task
behavioral21
Sample
78d4fce0c253356bf72cf72f260f27a3f0f3cf0a904a3618f3011cbe0b4e882e.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
7c27b9fef6e94e99092fb628716ae9114385d4d5753f72bff1221bad2eb54933.exe
Resource
win7-20240705-en
Behavioral task
behavioral23
Sample
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
995a91e668b85a992c8a71aed191fa0fafa3b1606bf205bef93a2457786de555.exe
Resource
win7-20240704-en
Behavioral task
behavioral25
Sample
9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe
Resource
win7-20240705-en
Behavioral task
behavioral27
Sample
a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b.exe
Resource
win7-20240708-en
Behavioral task
behavioral29
Sample
b098486c49a73591ca003f20276f1ca33605618a7167407d9f3f096bc7ec930d.exe
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
b923f1d2ece074dabe58bb6a603ed5d49e8d62044a1293a37e8afbcac029dded.exe
Resource
win7-20240708-en
Behavioral task
behavioral31
Sample
bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
c3fb821138d38ef9a2b0c77a4a3572ca38499b2dac3530c4a5faf2f789d57fc1.exe
Resource
win7-20240708-en
General
-
Target
a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe
-
Size
396KB
-
MD5
de74e1eb8ca5494496632da478851ade
-
SHA1
99f22f4fa9a0619b9f09e15afc6446160ae6541e
-
SHA256
a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240
-
SHA512
3f4daf1ed4e877b8afc746784ce697beea7cdd19b220b7a8535ba378906ebd7d9bd7c0ecdc11a7e952e050ffc31b7fa9cced324b33a45a8df682dd2f7f0519d2
-
SSDEEP
6144:JE9yDzN5oqKVsJAC328uO6s1wQW877buWxjy/qj+aA/H4:+EDJ5ofs9BuOB1wQW87XuWxM
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral26/memory/1856-0-0x00000000064C0000-0x0000000006528000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
pid pid_target Process procid_target 2092 1856 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2092 1856 a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe 30 PID 1856 wrote to memory of 2092 1856 a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe 30 PID 1856 wrote to memory of 2092 1856 a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe 30 PID 1856 wrote to memory of 2092 1856 a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe"C:\Users\Admin\AppData\Local\Temp\a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1602⤵
- Program crash
PID:2092
-