Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 18:43
General
-
Target
073a1ca920dd4ea967c2b3b875a93064aba05da319ddd5b330bbf48d18a314d4.exe
-
Size
1.1MB
-
MD5
b82af437d62c323d69f73072800355a4
-
SHA1
9f38efb058e2e931f7768f5eaf173873b954258f
-
SHA256
073a1ca920dd4ea967c2b3b875a93064aba05da319ddd5b330bbf48d18a314d4
-
SHA512
ac0fd3d960e3a8ea5d35e02fe1b4df616948f9a40b1b1bb0e42b3d1d941957571fb2e63890163a7acb10c683f5face489307c66e3d2a2422a994e461aa6b1e97
-
SSDEEP
24576:ypSSRhZFvsEBFumx8eDmCfPVLHhz3eAD4pbSHw/cDKgM3Ty+K8:ypSS7AEBF8eDPNHNxMbSHw/eKgST1b
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader First Stage 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\073a1ca920dd4ea967c2b3b875a93064aba05da319ddd5b330bbf48d18a314d4.exe"C:\Users\Admin\AppData\Local\Temp\073a1ca920dd4ea967c2b3b875a93064aba05da319ddd5b330bbf48d18a314d4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INSB8B1.tmpC:\Users\Admin\AppData\Local\Temp\INSB8B1.tmp /SL3 $E0054 C:\Users\Admin\AppData\Local\Temp\073a1ca920dd4ea967c2b3b875a93064aba05da319ddd5b330bbf48d18a314d4.exe 1070831 1074277 655362⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD58c0e2b408af6dc79c4e0252988097e14
SHA1a0973fb6985d3c959448ba4ec3476339f30eb97b
SHA25606e98db809d9d7785ced0d149d20a3c8fa943371446439e3c1d18983cb885249
SHA512d05e7fc17da4eed2138802b5f93fbcd64040a26da96219269c49399dcf955dbac9d909eac6888c0942873744e72548efbe94bf2893ec7c45fb664347c44435ae
-
Filesize
1.5MB
MD5b802e159ed7deffb96eff2c62f711a40
SHA19e47fea853dd8c6346fc77d34952b6d57d71aace
SHA25687cb8763dc50a6c84430bb259280b86bb63725ae90354b7253363a71fe164fea
SHA512e8aa81769c0fd2f287f41fec2240ed637860ad99130c4c0c5d26eb41cc126520312fe6eb8a0bcb118bed7c7aaff93ea5a43597e4125f49e8cfda313cd4ac1bb6
-
Filesize
481KB
MD58a9dd2367a2ea516265e256259d3ddbd
SHA1f28f99914149bbb2cba8747bc67a06b36ac96d15
SHA256af7200ba3f315a97fbbb2a61c24c6069fbac22e9a4014b8e92b19344a8bef989
SHA5126f4cfb824a473826e1b1ac448820a81559479eba6ddbc535b8a7aa393f98053549c24716c9aec8e105f68fc4d32d489a878539ed4b5668ee06a29289b3a7fca8
-
Filesize
32KB
MD559a7e0fa5404db5e9f1f18e2a2f69797
SHA143045d5102ad7e552e0c674dcddbd6f3e207fb62
SHA2565bcc823ba75c9bf6a8e01101eb5cee690fd3dcb2d635432ad4e26bf76024954c
SHA512296671e7082dbde345f5a92af947c56ac5c73eefe9c47606347ac55a54864675e038d70ed4efc01623fd9780eaa2d49dad68474e294704bcccc8333e3a0a41f2
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
96KB
-
Filesize
96KB