Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-12-2024 11:21

General

  • Target

    ORDER REQUIRED DETAILS FOR COMPANY.exe

  • Size

    930KB

  • MD5

    3e0497676ffe40cc443ac29438f92b18

  • SHA1

    042b14a498d9f8c2c7ad2a1127710e5e3361342e

  • SHA256

    89882ef5b9491ab9897666dd3fa56f738a84e2ec474099e7564c78e562b91035

  • SHA512

    5ada0f1b33fa0709302b8da2e33d23c549ba53442d9159cb6941f05b4f31dae9776bf3984545c1391bfdd1d196708a7eee7f341278d3c079235d59068dd76ec9

  • SSDEEP

    24576:R7sP5Kw0G1OAc8msbN0o2IDGHfPMFQJQI/zN:R8o9G1bTcfPMFQJQI/zN

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 61 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ORDER REQUIRED DETAILS FOR COMPANY.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDER REQUIRED DETAILS FOR COMPANY.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 696
      2⤵
      • Program crash
      PID:376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2516-0-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2516-2-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-1-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2516-4-0x0000000000400000-0x00000000004F1000-memory.dmp

    Filesize

    964KB

  • memory/2516-7-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-9-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-10-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-12-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-13-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-16-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-8-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-20-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-22-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-26-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-24-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-27-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-28-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-33-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-37-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-38-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-11-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-42-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-47-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-48-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-51-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-49-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-55-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-53-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-45-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-57-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-44-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-39-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-35-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-34-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-30-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-19-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-14-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-59-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-62-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-64-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-67-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-69-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-15-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-72-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-74-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-76-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-79-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-81-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-83-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-86-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-32-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-50-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-46-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-43-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-41-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-40-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-36-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-31-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-29-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-25-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-23-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-21-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-18-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2516-17-0x00000000033D0000-0x00000000043D0000-memory.dmp

    Filesize

    16.0MB