Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 09:22

General

  • Target

    IBKB.vbs

  • Size

    1.6MB

  • MD5

    7bbca6f64625872be1a4dba80d36fce1

  • SHA1

    a689a21b1b8a556b7e77be10f2e7ddc0dff7d360

  • SHA256

    d61aad06edbdd7500c507a9df016cfbdc6a21731bd707c51d97abebf687c76b6

  • SHA512

    faf0cbcfa48c56ac77cd4f7b7e7dcc1c2c42908eb430493d36444e1c0de6b8f77326a051f34d34370e7f0134a079424e7e5e86d6a1451b03f5a598a77433f5d1

  • SSDEEP

    24576:EIvgQAdJSSNSo4oRUTvt13g+qA+aj1tHKUJS2t9HqG7ZaSJyhh4B:vgQUNSo4oebUHYRdzSCrYc

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 61 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IBKB.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Users\Admin\AppData\Local\Temp\x.exe
      "C:\Users\Admin\AppData\Local\Temp\x.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 672
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\x.exe

    Filesize

    1.2MB

    MD5

    53f0663219e6091cecd600c59389711f

    SHA1

    f1986a61c2cb0107444fbd3e8075a25e21fb26ca

    SHA256

    0161d30defee14b9bdac49068c63a344320c11330acdfc10952c025637684adb

    SHA512

    9d466680cc90f57ada29495e32592084ec6daf37cdc53f2776a720d66f0284b09c619a25c9ede8e73e91b8c20d2a7ab5dfee0504ba7454389ce842afd27962a1

  • memory/2440-7-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2440-8-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-10-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-11-0x0000000000400000-0x0000000000535000-memory.dmp

    Filesize

    1.2MB

  • memory/2440-93-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-22-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-66-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-64-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-63-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-59-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-58-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-56-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-55-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-52-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-51-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-50-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-47-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-45-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-44-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-43-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-41-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-39-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-15-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-37-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-36-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-33-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-32-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-30-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-29-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-27-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-24-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-23-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-20-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-19-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-62-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-18-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-54-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-48-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-17-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-16-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-40-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-35-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-14-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-26-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-89-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-21-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-84-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-80-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-77-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-73-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-69-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-65-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-60-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-57-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-53-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-49-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-46-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-42-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-38-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-34-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-31-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-28-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-25-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB

  • memory/2440-13-0x0000000003500000-0x0000000004500000-memory.dmp

    Filesize

    16.0MB