Analysis
-
max time kernel
890s -
max time network
413s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
-
submitted
07-01-2025 19:01
General
-
Target
Client.exe
-
Size
3.4MB
-
MD5
96b45a03dcf66efe05bc4d585281bdd1
-
SHA1
0f8ac17b72a43418b3c9a1aace204228e26c32ab
-
SHA256
0d72b72773bb854b9dcdc83c5a0f76bcc5a6a1a344f28f81500d6aaaf8d2e69d
-
SHA512
c8f6da8d660b5875b71601620d7e66571c2190223ce6005bbdecaa47fec45c162e50bbb640b457e379ab62bf86985b5f338430d22dcbcf4f28356c8e92c3ecab
-
SSDEEP
49152:93Xec2c6RsjdmQbInhWTRTTRMqTy4moMbbo9ALzjg4z7gDN:9v6RsihkRYX1IMjgqKN
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 5 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20B
MD593732eb3b7cf28e39930d3a9849f59b2
SHA1b500da9c440cf02bf5d902c193ba1ea55f6700af
SHA256dfc1e0b6b06ea3c55897e5d4eb4bf732072cefdd4d7c9958b06c56ebc1d1d0b9
SHA51206f41406f1c2ca30ed300c567f8c7aae775fb3b06379e836bf3232f7699e8042e4947246745da889ca58fcf44a988f4217fb9dd00a57a81dcacd767d405dff47
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.4MB
-
Filesize
4KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB