Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 05:17
Static task
static1
Behavioral task
behavioral1
Sample
b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe
Resource
win10v2004-20241007-en
General
-
Target
b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe
-
Size
1.2MB
-
MD5
94e2322cfb195c32345395b16a322140
-
SHA1
930ea88ab9e2109e7c6035583750d92f10da4c2c
-
SHA256
b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26
-
SHA512
40ba62274ec46345f1dad95111c6351fe82ef508bf4b2c3e6f77a96de43588e6b8a6c9230bef996bbd52cdb46ff30c14b0ce28fb0a4803fe9c398a9307f2d23d
-
SSDEEP
24576:8sqCMKzL0rxr152q8Na6HR2zlPQxL/F99UljJes8lSnQ:85KMXQNYOLSes8lSQ
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral1/memory/2280-2-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-11-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-10-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-9-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-12-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-8-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-7-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-6-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-14-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-16-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-20-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-19-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-18-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-17-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-15-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-13-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-21-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-27-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-41-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-22-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-29-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-23-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-30-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-49-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-52-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-55-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-24-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-58-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-62-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-25-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-26-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-69-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-73-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-76-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-28-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-39-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-44-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-31-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-48-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-32-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-33-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-56-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-34-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-63-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-35-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-36-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-60-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-59-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-57-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-54-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-53-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-51-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-50-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-47-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-46-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-45-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-43-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-42-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-40-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-38-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 behavioral1/memory/2280-37-0x00000000036B0000-0x00000000046B0000-memory.dmp modiloader_stage2 -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 bitbucket.org 4 bitbucket.org -
Program crash 1 IoCs
pid pid_target Process procid_target 2152 2280 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2152 2280 b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe 30 PID 2280 wrote to memory of 2152 2280 b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe 30 PID 2280 wrote to memory of 2152 2280 b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe 30 PID 2280 wrote to memory of 2152 2280 b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe"C:\Users\Admin\AppData\Local\Temp\b0c42b2501941eedb36be87c9433a07caf4b3af9e11ac2fc81164cfbff150d26.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 7042⤵
- Program crash
PID:2152
-