Analysis
-
max time kernel
2s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
01-11-2024 14:59
General
-
Target
8f5936f3ebe5598bea2c561c4dc118eeb836ad393ec11e4ccfd9fde43a461cd8.exe
-
Size
338KB
-
MD5
a6bdcd6f1b10c86b88f8be60b25f29b1
-
SHA1
ab2840ed40b083ccf1e4045e93d3095530239587
-
SHA256
8f5936f3ebe5598bea2c561c4dc118eeb836ad393ec11e4ccfd9fde43a461cd8
-
SHA512
31f3d3bc5cd507f4e5c04db5bf23b2f8f1e67905e5d9a0be929e0617b01c47a5bdefc50f89adc1e8bd0988dbd8dc1c6910e5d58be47c8375124d18f412701f2b
-
SSDEEP
3072:bc3sBG7mXh7m/zZM3jAbNOM6CNtDCZFc/:w3sBz0Z4Mj72F
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f5936f3ebe5598bea2c561c4dc118eeb836ad393ec11e4ccfd9fde43a461cd8.exe"C:\Users\Admin\AppData\Local\Temp\8f5936f3ebe5598bea2c561c4dc118eeb836ad393ec11e4ccfd9fde43a461cd8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\8f5936f3ebe5598bea2c561c4dc118eeb836ad393ec11e4ccfd9fde43a461cd8.exe"C:\Users\Admin\AppData\Local\Temp\8f5936f3ebe5598bea2c561c4dc118eeb836ad393ec11e4ccfd9fde43a461cd8.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JOKLW.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
338KB
MD584562b36fe9c97536711d055af7bb455
SHA110dc5cd850192bb206188e6fbddf17c02301d4dc
SHA25672a7a76a9b674a1cba0c47e7fca77b2b191320069c658e6271eaf0194893cdfb
SHA5128b8e33b694942158e8eaf8fd56443b55f63f50bca54d736dffe7b8c43bab5b86a12e2d522365d1ae4e410e2a5ce7d703c6c71c1c30761e4fb70eddc84c2aba60
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
348KB
-
Filesize
1024KB
-
Filesize
348KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
348KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
348KB
-
Filesize
44KB
-
Filesize
348KB
-
Filesize
44KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
44KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
44KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB