Analysis
-
max time kernel
119s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-12-2024 01:47
General
-
Target
8ac249d11b72e316c19e9c50ca478b94e5a9f2b62a8bc2d42a93426ab8d3c5c9.exe
-
Size
1.1MB
-
MD5
9f97c6946d863bb2eb3dac8cfccaf40e
-
SHA1
7f074955d77e9b3148650fbe523007f4017fb392
-
SHA256
8ac249d11b72e316c19e9c50ca478b94e5a9f2b62a8bc2d42a93426ab8d3c5c9
-
SHA512
b7da02ba92ac42ed95c5a4ce3d4ee3e7d6a4fd9ff1112ef126e794886b9c27474900ed64e24133c959e9ef8eaa6d7c3383dbde7e22beb10361b9eafe107a14de
-
SSDEEP
24576:yfOy1rX1TUiLlPEIhHp6wbTrnw6sEEFMI65wRcn/gOj:yGQj1TL5EU6Zx/MIgL
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader First Stage 11 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 19 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ac249d11b72e316c19e9c50ca478b94e5a9f2b62a8bc2d42a93426ab8d3c5c9.exe"C:\Users\Admin\AppData\Local\Temp\8ac249d11b72e316c19e9c50ca478b94e5a9f2b62a8bc2d42a93426ab8d3c5c9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-J3RNS.tmp\is-A68TK.tmp"C:\Users\Admin\AppData\Local\Temp\is-J3RNS.tmp\is-A68TK.tmp" /SL4 $80060 "C:\Users\Admin\AppData\Local\Temp\8ac249d11b72e316c19e9c50ca478b94e5a9f2b62a8bc2d42a93426ab8d3c5c9.exe" 941118 522242⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ChristmasTree\ChristmasTree.exe"C:\Program Files (x86)\ChristmasTree\ChristmasTree.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
819KB
MD57db70f85c13beb3d0f5e5ca9fb25c97a
SHA1c3e5d08b7eb0d869606ff614be56c5eef1b601ff
SHA256b2dd32551d94ceadc4e3f5f46f79ad429e27a60d17e467a169ddca63768dab01
SHA512843499c48db3a3bf23d70cc0d12d165c0d98cb923d53a4682d5853ca85f56457b1c19e52696ec9d682ede71a93d6190c1f8056195d9bc47a136bac79fea2257b
-
Filesize
48KB
MD551c106a15450aa56d83173dd4591e67c
SHA18e76b06576343b0b38065ecfd5b32372c27fe36b
SHA256361e45cf5d77f2a36d5e4bccca7324abe4d39b9f7362b9b47bb68fd06e7d4f72
SHA51246fae4a91c35697db0e4f759039bb25add640bab0a5710e57f49c537d0cc66a6a9c461192a4c6ef5a9db97f2708e8770f6eb23ea4c02b850d1debff66a253d33
-
Filesize
399B
MD550b25dce1fa044029f1c15838eb468fa
SHA1ad8854ed420647974651dcb597679cb38ee98159
SHA2568ece84fcee3709e48b8dfe688242109161f4605b429e7ba736a22de74af1c972
SHA51294dbebab0b28ef0d9f1c0626ae62a17caaac8d2c74c0ddf185a8033e345f18151ce507b95d44cea8a63963fd0f57289ef1b1b3c2f1b58824aefecec73529937a
-
Filesize
656KB
MD54fa180886ff7c0fd86a65f760ede6318
SHA12c89c271c71531362e84ddab5d3028f0756a9281
SHA2561d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c
SHA512a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
36KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
