Analysis
-
max time kernel
23s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
05-10-2024 03:32
General
-
Target
5e0f2aa7fe9d710d4ca930ad51ce281dec77a15318588b244e0ee90136f1bc8bN.exe
-
Size
40KB
-
MD5
b3db99f08003ca1fa6d09fe9ea1ffa10
-
SHA1
2cea12eaf9af01d5b434dcb54ff52bdb48927410
-
SHA256
5e0f2aa7fe9d710d4ca930ad51ce281dec77a15318588b244e0ee90136f1bc8b
-
SHA512
796714423ec16c635bdd3497057ef7f34b60590125ed7fbf27f1d16fc6ed2a514be07e42ba7fd9cfb80eda9dcbc5183ccfb96a034fe637473ac1f912f150c866
-
SSDEEP
768:B4B2JGYVNfV6vrFDPwp2Gt7YHN0m5vcdXwPXDzHvzExAPOE/3MwVrJ7H8oWXRrKe:BC2oAfIrJwp2Gium5vcxwPzzvzEx6L/4
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e0f2aa7fe9d710d4ca930ad51ce281dec77a15318588b244e0ee90136f1bc8bN.exe"C:\Users\Admin\AppData\Local\Temp\5e0f2aa7fe9d710d4ca930ad51ce281dec77a15318588b244e0ee90136f1bc8bN.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5f78912692c305a97d6f1221cf7219cba
SHA1f7f9342bbafad523c0791f5a604f995ff5a95a57
SHA2565fecfff7e78bdc8b1240b13fa53f029bdfc35f7bf7c114463c9aa619bd32cdbe
SHA512f90c05c9ad516f5a3982df41e63192ab1479f312d084907bea56d3927502eb57641222405553ba7acf89eb7d9bc9c17669445faadf71e143deff6eea40eef752
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
144KB