Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
lista de facturas vencidas.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
lista de facturas vencidas.exe
Resource
win10v2004-20241007-en
General
-
Target
lista de facturas vencidas.exe
-
Size
885KB
-
MD5
3c91fb9259d95af34c41320bbb997469
-
SHA1
578f6f96b493c0606a6754ab8d6f34748f79eabb
-
SHA256
44df3599844e619c3f899c7689c843ba9e62149e772acd184996a59d7279071d
-
SHA512
16861861fe01fc72e0c251c100147f39278c28a8ba5ca983e32572b30b1d61b555ae8a7d6cbda3073987eaf8277e2a8ce0ea77be41cd49d37ad96d09c82d8e59
-
SSDEEP
12288:+dvSgikKHSXrFGZ/1nPaPih+gTiwCAI5T7grmN7vwui44YXas4E+Jymf7fv:+dkDSXrAzaNaizeaNydYXas4E+Dv
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 59 IoCs
resource yara_rule behavioral2/memory/3932-12-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-19-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-24-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-23-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-25-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-29-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-27-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-28-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-26-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-33-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-36-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-38-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-39-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-37-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-35-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-34-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-40-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-42-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-45-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-44-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-43-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-46-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-48-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-51-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-52-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-50-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-49-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-47-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-53-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-55-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-58-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-57-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-56-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-59-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-61-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-64-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-65-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-66-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-63-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-62-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-60-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-68-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-71-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-70-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-69-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-72-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-74-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-79-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-78-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-77-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-76-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-75-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-73-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-81-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-84-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-83-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-82-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-85-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 behavioral2/memory/3932-86-0x00000000028E0000-0x0000000002932000-memory.dmp modiloader_stage2 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lista de facturas vencidas.exe