Analysis
-
max time kernel
119s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
05-12-2024 19:23
General
-
Target
508a8ec61616dd08e643f340eca219031c80f4600b2ca171a49bd5df2e4f7e3fN.exe
-
Size
1.1MB
-
MD5
b2d4111d11a19733ff2ff51a18f714a0
-
SHA1
fd68c75108c7a70c08f58c087d3d07796759aa91
-
SHA256
508a8ec61616dd08e643f340eca219031c80f4600b2ca171a49bd5df2e4f7e3f
-
SHA512
a7e865607a8bd90cc613f1f75989396f544b1449c56d31f165f17dc9e14b9fc5e0f49e493555923fe174fe19cb0b33cf2325f883813a3a5216f5e3fa1003acce
-
SSDEEP
24576:yfOy1rX1TUiLlPEIhHp6wbTrnw6sEEFMI65wRcn/gOL:yGQj1TL5EU6Zx/MIgT
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader First Stage 9 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 19 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\508a8ec61616dd08e643f340eca219031c80f4600b2ca171a49bd5df2e4f7e3fN.exe"C:\Users\Admin\AppData\Local\Temp\508a8ec61616dd08e643f340eca219031c80f4600b2ca171a49bd5df2e4f7e3fN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8RA3K.tmp\is-HNDHI.tmp"C:\Users\Admin\AppData\Local\Temp\is-8RA3K.tmp\is-HNDHI.tmp" /SL4 $400F4 "C:\Users\Admin\AppData\Local\Temp\508a8ec61616dd08e643f340eca219031c80f4600b2ca171a49bd5df2e4f7e3fN.exe" 941118 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ChristmasTree\ChristmasTree.exe"C:\Program Files (x86)\ChristmasTree\ChristmasTree.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD551c106a15450aa56d83173dd4591e67c
SHA18e76b06576343b0b38065ecfd5b32372c27fe36b
SHA256361e45cf5d77f2a36d5e4bccca7324abe4d39b9f7362b9b47bb68fd06e7d4f72
SHA51246fae4a91c35697db0e4f759039bb25add640bab0a5710e57f49c537d0cc66a6a9c461192a4c6ef5a9db97f2708e8770f6eb23ea4c02b850d1debff66a253d33
-
Filesize
399B
MD550b25dce1fa044029f1c15838eb468fa
SHA1ad8854ed420647974651dcb597679cb38ee98159
SHA2568ece84fcee3709e48b8dfe688242109161f4605b429e7ba736a22de74af1c972
SHA51294dbebab0b28ef0d9f1c0626ae62a17caaac8d2c74c0ddf185a8033e345f18151ce507b95d44cea8a63963fd0f57289ef1b1b3c2f1b58824aefecec73529937a
-
Filesize
819KB
MD57db70f85c13beb3d0f5e5ca9fb25c97a
SHA1c3e5d08b7eb0d869606ff614be56c5eef1b601ff
SHA256b2dd32551d94ceadc4e3f5f46f79ad429e27a60d17e467a169ddca63768dab01
SHA512843499c48db3a3bf23d70cc0d12d165c0d98cb923d53a4682d5853ca85f56457b1c19e52696ec9d682ede71a93d6190c1f8056195d9bc47a136bac79fea2257b
-
Filesize
666KB
MD54da265821c25c7576a408f79a7b41f79
SHA1ed8413b508430b3fdde527c8939cf79bbbf24fd4
SHA25686ade33d4f2021f687105e37211df96bfb2cb437fb28265106df970ac7a24ac3
SHA512ffc8f9d2a54977d21114f5c14591546b6b346c6a3d13f553c4525e2d02e8c4877d24b2d7eec1253db05f6b1732bdd50cba2512239506c9c147e7884ffb791405
-
Filesize
656KB
MD54fa180886ff7c0fd86a65f760ede6318
SHA12c89c271c71531362e84ddab5d3028f0756a9281
SHA2561d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c
SHA512a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
36KB
-
Filesize
76KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
