Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-12-2024 19:21
General
-
Target
1f6d89c592e6ab42b7b8eac66d8ebad6c019fe8426d94dd9b03dfada6071dc1a.exe
-
Size
1.1MB
-
MD5
5ee0f68fb48c14662d45d26eceb665ff
-
SHA1
6db78b80bb5e0dc31875690de686b233d3eabc8a
-
SHA256
1f6d89c592e6ab42b7b8eac66d8ebad6c019fe8426d94dd9b03dfada6071dc1a
-
SHA512
295bc60678a632a07b31e234f72c9d99f7bd8424774c504dec2239b4b6c8a4511aa7ca47d7e6a091d3b9fdd50b741064261fe9e7c29ac33217392c8d5eae36a4
-
SSDEEP
12288:wsBMK53JiGWJs/HtuuQtIxDt9Fni6xh3xOw52LXb/08fVez+A/dk60xaO0ZH0ulr:woHRWs4W1tfiEkXbGzWcRb6i
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader First Stage 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f6d89c592e6ab42b7b8eac66d8ebad6c019fe8426d94dd9b03dfada6071dc1a.exe"C:\Users\Admin\AppData\Local\Temp\1f6d89c592e6ab42b7b8eac66d8ebad6c019fe8426d94dd9b03dfada6071dc1a.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
1.1MB