Analysis
-
max time kernel
37s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 03:07
General
-
Target
PO_2024_056209_MQ04865_ENQ_1045 (1).gz
-
Size
943KB
-
MD5
6271861abdb95e51f6849c843acdae62
-
SHA1
66cc315ad98bd5bae2ffb11729bbfdae8eefa85a
-
SHA256
aae8699a908c3ca5211006647460cb8eb15c517a7cbf4a45bbf7909977317faf
-
SHA512
90a117bbfc1251361d0e8900675c6846511598544dd1df0d3eb6b2ec982a5b83bea4b81eeee9991ca84cdc44785573bc9e79eff9ff417f747990e635a42f59fb
-
SSDEEP
24576:yKMYBN1/giWrlz3+rRu+P+FBVIceG7VX6BUxWDbuLmfq/wTL:1MI/giUlr+rRu+2FE5G7VKCxlLmS/wX
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PO_2024_056209_MQ04865_ENQ_1045 (1).gz"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zOC9962987\PO_2024_056209_MQ04865_ENQ_1045.cmd" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\findstr.exefindstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\7zOC9962987\PO_2024_056209_MQ04865_ENQ_1045.cmd"3⤵
-
-
C:\Windows\system32\cscript.execscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\x.exeC:\Users\Admin\AppData\Local\Temp\x.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5e74e6f735a0aabae7ea551ec00081be9
SHA1e21c6050c4b5598be0db7fff9abefdfcb8a78f04
SHA256e66a156bc6d1ef4b56a572c4133de2559388152dc36d1f35860e2defa566caaa
SHA512e26c43246087b24b40642f7fb412210a0cce295ce3009136d08596bcc644f74f4734e7f1375f2117d89a8935636d002d7b6c3065cd9aa2380a50c96d54c093c0
-
Filesize
1.8MB
MD5bf38536008977969fa57ff4fca96af75
SHA11ff7c41ce6d80f772f6fa32e667285587ee21cbd
SHA2565171548d61d342b89a92969bb13e4431ea8acd46a7146f448ebdb49639f19e9f
SHA512f14c7a41d2e1b40b735071648db81d8cac2e5180a2062351365109ce384bcb317d7bc7ecbfb416d7614c1cdcae8c29180f937585e87b6ef43bcca8bbbe4046f1
-
Filesize
8KB
MD59332a64adbfe1fa96e85f32d467a7663
SHA108b142374417eb8dbc33b8287161debc8042c18e
SHA256db7984e4f4e7ecf2f4ff1c3648c51d6348bd47bfe5f9e4fd696a1aae146bd90b
SHA5127e775dc57928893650ac272877cb5c9a7b1be6ce1eeec6ef047fe607155736ebba9971cc2dfbbc9de01a9a793aab31ac059581b9e5714380f24b7cec8f473321
-
Filesize
1.3MB
MD5d1f6b3bd433945255249291310f2e59e
SHA1b5a2b9ec979e17c4d1074e7d1a23b550cce578d5
SHA2567886e0dcb78a5d5e67f9d28272c24a29139accf9ff7616b659ffeb3eeaf1603a
SHA512116e88e5e5b4db7086d5efe759a3b7883ded9cd691327e3f71aee61f0920805a21118d801231b7c091c4ee8e7beca6f5efadd577031336775bc93f2bcbec2b5b
-
Filesize
380B
MD5ec9a2fb69a379d913a4e0a953cd3b97c
SHA1a0303ed9f787c042071a1286bba43a5bbdd0679e
SHA256cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b
SHA512fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6
-
Filesize
8KB
MD560cd0be570decd49e4798554639a05ae
SHA1bd7bed69d9ab9a20b5263d74921c453f38477bcb
SHA256ca6a6c849496453990beceef8c192d90908c0c615fa0a1d01bcd464bad6966a5
SHA512ab3dbdb4ed95a0cb4072b23dd241149f48ecff8a69f16d81648e825d9d81a55954e5dd9bc46d3d7408421df30c901b9ad1385d1e70793fa8d715c86c9e800c57
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
1.3MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB