Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03/11/2024, 00:29
General
-
Target
Foto2avi.exe
-
Size
2.7MB
-
MD5
e4c1623e0298def5ff1b3a13bc50020e
-
SHA1
371b75b6c102207c5ad2d761689770a23b1ee93b
-
SHA256
ffb570199f61559a7aa4375c6ca2be87fcb4ececb4617dd275ba54123374c2d5
-
SHA512
13485f73167aa468c31e2be6f0ed9a1b91c6740f04777f026ab7faef40da5a3cd64057002cd0ed8f14e5fffc8ce0f1c3efc352c8aa8d8b5c1de34eb84d14d4bf
-
SSDEEP
24576:Tvw9CVXHoo79kQADOFI3wgwVlxOujXso5VLGz2wQ2B/qtTqK90ZpyxK:blYORADuVWERLGs2yTqK90ZpcK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader First Stage 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Foto2avi.exe"C:\Users\Admin\AppData\Local\Temp\Foto2avi.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54eb6a13cf1a645d485973c8786bbfde0
SHA11158794d67a1a8297d6121127d6a1b70917866f3
SHA256ebaeb692de426bc97535a60f4867dfd43638bd2aece16a274d85df32fd5a1ff4
SHA512c8926cbf26e18b7fbcbdccf0797d2bf5ee7f22f9e4d9abea3a4553ce33a757a4902d82fc4c771b2fda8ebd5614f313bc03a81caa446b61e16f233025b5991310
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB