Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    08-01-2025 20:52

General

  • Target

    cd22ac4b3900f7ec6f4eeb84a92cd8522a0a630344ffac5ff73427419af1ec9e.exe

  • Size

    344KB

  • MD5

    286f86eb25ee6271df4840f53901c46e

  • SHA1

    5b592d8942120b99df34be443a5bd0ba2ffaa883

  • SHA256

    cd22ac4b3900f7ec6f4eeb84a92cd8522a0a630344ffac5ff73427419af1ec9e

  • SHA512

    33ee1a2791019e398b4171adb26a9fc0be698c10cb657460f6f0cdc53f4956e0735737de657c2c8c46940f6bc70b9c8234d5bb3768f014277ef112088dae5d43

  • SSDEEP

    6144:Zu1cbOp7CGR6SF6/t0oZYG/uZWttmdNautb5r0PT1:QibOpml1R1mZWTXCOJ

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • ModiLoader Second Stage 42 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd22ac4b3900f7ec6f4eeb84a92cd8522a0a630344ffac5ff73427419af1ec9e.exe
    "C:\Users\Admin\AppData\Local\Temp\cd22ac4b3900f7ec6f4eeb84a92cd8522a0a630344ffac5ff73427419af1ec9e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\cd22ac4b3900f7ec6f4eeb84a92cd8522a0a630344ffac5ff73427419af1ec9e.exe
      "C:\Users\Admin\AppData\Local\Temp\cd22ac4b3900f7ec6f4eeb84a92cd8522a0a630344ffac5ff73427419af1ec9e.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Windows\SysWOW64\svchost.exe
        "svchost.exe"
        3⤵
        • Looks for VirtualBox Guest Additions in registry
        • Adds policy Run key to start application
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Deletes itself
        • Adds Run key to start application
        • Maps connected drives based on registry
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\SysWOW64\svchost.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2688
        • C:\Windows\SysWOW64\explorer.exe
          "explorer.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2108-2-0x0000000000310000-0x0000000000315000-memory.dmp

    Filesize

    20KB

  • memory/2108-4-0x0000000000310000-0x0000000000315000-memory.dmp

    Filesize

    20KB

  • memory/2248-6-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2248-7-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2248-3-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2448-34-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-54-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-13-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-32-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-17-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-15-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-14-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-18-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-19-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-20-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-21-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-22-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-66-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-38-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-65-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-62-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-61-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-31-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-60-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-35-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-10-0x00000000003B0000-0x00000000003B8000-memory.dmp

    Filesize

    32KB

  • memory/2448-33-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-16-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-64-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-56-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-30-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-57-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-58-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-59-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2448-12-0x00000000003B0000-0x00000000003B8000-memory.dmp

    Filesize

    32KB

  • memory/2448-55-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/2668-41-0x00000000005B0000-0x0000000000831000-memory.dmp

    Filesize

    2.5MB

  • memory/2668-47-0x00000000000F0000-0x00000000001AA000-memory.dmp

    Filesize

    744KB

  • memory/2668-43-0x00000000000F0000-0x00000000001AA000-memory.dmp

    Filesize

    744KB

  • memory/2668-44-0x00000000000F0000-0x00000000001AA000-memory.dmp

    Filesize

    744KB

  • memory/2668-45-0x00000000000F0000-0x00000000001AA000-memory.dmp

    Filesize

    744KB

  • memory/2668-42-0x00000000000F0000-0x00000000001AA000-memory.dmp

    Filesize

    744KB

  • memory/2668-40-0x00000000005B0000-0x0000000000831000-memory.dmp

    Filesize

    2.5MB

  • memory/2688-28-0x0000000000080000-0x000000000013A000-memory.dmp

    Filesize

    744KB

  • memory/2688-27-0x0000000000080000-0x000000000013A000-memory.dmp

    Filesize

    744KB

  • memory/2688-29-0x0000000000080000-0x000000000013A000-memory.dmp

    Filesize

    744KB

  • memory/2688-26-0x0000000000080000-0x000000000013A000-memory.dmp

    Filesize

    744KB

  • memory/2688-25-0x0000000000080000-0x000000000013A000-memory.dmp

    Filesize

    744KB

  • memory/2688-24-0x00000000003B0000-0x00000000003B8000-memory.dmp

    Filesize

    32KB

  • memory/2688-23-0x00000000003B0000-0x00000000003B8000-memory.dmp

    Filesize

    32KB