Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 07:15 UTC
Behavioral task
behavioral1
Sample
ce0ff4f686af11c0b9802920d2a292d22b29672808070281e35f7c27347aed7b.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ce0ff4f686af11c0b9802920d2a292d22b29672808070281e35f7c27347aed7b.dll
Resource
win10v2004-20241007-en
General
-
Target
ce0ff4f686af11c0b9802920d2a292d22b29672808070281e35f7c27347aed7b.dll
-
Size
18KB
-
MD5
54c75085dac6aa322c0a65c9a0f32419
-
SHA1
a5d0e119d11b9919edef73c571efda92dd13db05
-
SHA256
ce0ff4f686af11c0b9802920d2a292d22b29672808070281e35f7c27347aed7b
-
SHA512
e13b80141d3595fb3df89c9596852a5f7c41eebfef80f45b0e7c2b55afcdf681f9dc4ab4533afbb5ea727b33d50bc2aa8342bc3d691bb7356f57551619f93f8b
-
SSDEEP
384:VzGJTEu2qc0lpLsz0/Cs0OqSHyf0mfIaUcNKCv+zfQp:VZu2qdlpLsz9jpSHyvIaUGvufO
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/4348-0-0x0000000000400000-0x000000000040B000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
pid pid_target Process procid_target 4468 4348 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1432 wrote to memory of 4348 1432 rundll32.exe 82 PID 1432 wrote to memory of 4348 1432 rundll32.exe 82 PID 1432 wrote to memory of 4348 1432 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ce0ff4f686af11c0b9802920d2a292d22b29672808070281e35f7c27347aed7b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ce0ff4f686af11c0b9802920d2a292d22b29672808070281e35f7c27347aed7b.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 6123⤵
- Program crash
PID:4468
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4348 -ip 43481⤵PID:832
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
68.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa