Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-01-2025 04:55
Static task
static1
Behavioral task
behavioral1
Sample
c5bca7a3116441ecd35079c150777c1ed03494d875ac1644db2d6cbe7fe330d8.js
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c5bca7a3116441ecd35079c150777c1ed03494d875ac1644db2d6cbe7fe330d8.js
Resource
win10v2004-20241007-en
General
-
Target
c5bca7a3116441ecd35079c150777c1ed03494d875ac1644db2d6cbe7fe330d8.js
-
Size
1.2MB
-
MD5
9981eb30689ed50fb6d83b3df9a4bf73
-
SHA1
aab7a42a0fe9cf3917edc001d2a106335c1b31d3
-
SHA256
c5bca7a3116441ecd35079c150777c1ed03494d875ac1644db2d6cbe7fe330d8
-
SHA512
fbe38f4785c234fa77f79ac740fb72620bc5be90d59551feb90d27f1424bad8cd4e0f033197d72c5761292df35a1c48dd61edc283f21d57e8880f26171d69fe2
-
SSDEEP
24576:BhHitPIlN14h1EWUPoNfkljva8wkIvmdHJGHpT86b0avp4kJL7a5ZKCmjLpvm:oR1lUPompvCSdvkw5w8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral1/memory/2876-9-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-13-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-14-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-15-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-16-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-19-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-18-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-20-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-27-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-21-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-17-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-39-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-22-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-41-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-45-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-47-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-23-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-52-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-56-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-31-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-24-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-65-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-32-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-70-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-72-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-75-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-25-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-79-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-82-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-84-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-87-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-26-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-91-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-35-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-28-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-46-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-29-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-30-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-51-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-58-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-33-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-34-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-42-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-64-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-63-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-62-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-60-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-59-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-57-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-55-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-54-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-53-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-50-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-49-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-48-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-44-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-43-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-40-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-38-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-37-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 behavioral1/memory/2876-36-0x0000000003180000-0x0000000004180000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2876 x.exe -
Loads dropped DLL 3 IoCs
pid Process 2660 WerFault.exe 2660 WerFault.exe 2660 WerFault.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2660 2876 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2876 2684 wscript.exe 30 PID 2684 wrote to memory of 2876 2684 wscript.exe 30 PID 2684 wrote to memory of 2876 2684 wscript.exe 30 PID 2684 wrote to memory of 2876 2684 wscript.exe 30 PID 2876 wrote to memory of 2660 2876 x.exe 32 PID 2876 wrote to memory of 2660 2876 x.exe 32 PID 2876 wrote to memory of 2660 2876 x.exe 32 PID 2876 wrote to memory of 2660 2876 x.exe 32
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\c5bca7a3116441ecd35079c150777c1ed03494d875ac1644db2d6cbe7fe330d8.js1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 7323⤵
- Loads dropped DLL
- Program crash
PID:2660
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
936KB
MD5d424db9928a204dde46947ca09a8c4cd
SHA10cadc446d07ac332182d0bf1a592a66b7f886931
SHA256d95889b63e296ee81026480507a4c45eb003c27de91e515fc6053a573dc998a0
SHA512d11507e9eb3a7f4e777484c87d4823bd280744a524e1a805b574e19c6d82c971b06b6ef920620c6b1c7df6aa5c3e37b609c76eb5b6fb7c31eec23560bd10d3ab