Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 16:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Documento de carta de porte de Dhl,pdf.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Documento de carta de porte de Dhl,pdf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
Documento de carta de porte de Dhl,pdf.exe
-
Size
684KB
-
MD5
757cc6207682ec829c36a9e62fedc1d8
-
SHA1
8460c24b5d1ee1873265beb324e83e43d7f56816
-
SHA256
c1dfc207e54b30fc1686efaa9037af9aa07f47fbfb0beba70493e9fb383b4d8e
-
SHA512
5b817219982699a53a80a2f422738ea2c359a9db24f8ad4f20b5bad9eee32bb3dbe7de77eb750b1ce84d7d9b4b5c36168236f8a810bd0228971f6f0a9dfeb70b
-
SSDEEP
12288:9bSAuiSYEczIDyTFiPKu5mHNKMyqcLHazX:9bS78z7PuCIHqRD
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader First Stage 2 IoCs
resource yara_rule behavioral2/memory/3876-274-0x0000000010410000-0x000000001042B000-memory.dmp modiloader_stage1 behavioral2/memory/3876-277-0x0000000010410000-0x000000001042B000-memory.dmp modiloader_stage1 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Documento de carta de porte de Dhl,pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Documento de carta de porte de Dhl,pdf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82 PID 3100 wrote to memory of 3876 3100 Documento de carta de porte de Dhl,pdf.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3876
-