Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-12-2024 05:06
General
-
Target
top flash to video.exe
-
Size
1.6MB
-
MD5
2aa4d2caa73ed5160cc34fba921236c1
-
SHA1
022d065ddb70ffa3bba898e183179772d7c484fd
-
SHA256
5e5ae825b31fa0863f8a3055379306e20ac9f3c554f121f4f0c29430f79e51cf
-
SHA512
3a3b0104b0005d1a158727ca51a797255616af0365090921db58cc70ec3a4a2cadb9a7630384af4cb7a5b134a9de5217bb7499cb02d13c9c92f6124a127fd7fd
-
SSDEEP
24576:G1tYL4dVpWK5GYFHGgGfqa2B7yzzLP0DTXYWCs/tSVmzvIPUrsj2WnkIdINwByd6:G1t5GYEaaD/YTKsVSVHPfnkII96
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\top flash to video.exe"C:\Users\Admin\AppData\Local\Temp\top flash to video.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 4642⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\CF06674C-EDA6-48df-B12C-F810984ACF54.exe"C:\Users\Admin\AppData\Local\Temp\CF06674C-EDA6-48df-B12C-F810984ACF54.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c5be6b4274a62a7be11d1c018235a79b
SHA1a6e81b63a198fee34498cd95c78dec73b6957bcc
SHA256551a361bbfb5e01e7de1656059736c0bc0d119d85d020f1b6c61867abc0ca778
SHA512c06d6820c5998f13be5eabb8dd32c5cf2da27168d6ade1defa934ff464e05be276728a02f30d7d803dc6d64ce5eb22a80d2769b0fd6e6517c8351e631daadfde
-
Filesize
1KB
MD5729ae66a977aa54d54dd03bf2a87d5d7
SHA12ba9c4b34bf0911674eab2f19cefd6364e39f61a
SHA25673ee3e8af16af5d1aaf3f5d4e17a939eb49485b219022e9401ad72cdaa97da76
SHA512ffceacc1a66c140805c1c73b89593b3a7076c59b7d67fd7ee06fc551445bd349f4cb2f4f3fe69304eb4a4da8faf280b9a0f7e3577f777fdfb393f56f10c5b85b
-
Filesize
1KB
MD5d88208b9dd72c1a24df73c2ba0684652
SHA1e4ee11ccc15525e3111112bac3d852029cfbaeea
SHA256c6fd6b659dd7ff6e29782c44a689e575f7d8261315f31ae315e268cfc672b11d
SHA512e21500ec0576f8f4e985b985b6ade0288dee7daf0e5248a5167dc0413f5ff65f871dc4c16562ee327dc47626f0db55689f61f98a7dc8a1a382192a743a317b61
-
Filesize
1KB
MD5a3c5c1fcf3586d717a9230d44754825d
SHA11ed948abcc0f8cc8f9c60f2269776b113883a593
SHA256600b20fa5b57f22b0d6576d358e90667901dfd3071b1f5ec06036ecc0c0ee45a
SHA512c9a7e55b7c1af6da64ff2dfafe16e7f1dff7a28a771643353f7b2805b65a80d8a8fca8f58ea04b92ceb293f2c7ed4ea53875499025517b6915d7ff0db968a86b
-
Filesize
8.8MB
-
Filesize
3.4MB
-
Filesize
36KB
-
Filesize
984KB
-
Filesize
8.8MB
-
Filesize
984KB
-
Filesize
8.8MB
-
Filesize
4KB
-
Filesize
8.8MB
-
Filesize
36KB
-
Filesize
984KB
-
Filesize
3.4MB