Analysis
-
max time kernel
12s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
02/04/2025, 00:08
General
-
Target
sihost.exe
-
Size
1.6MB
-
MD5
d245c0efade78fbe55c9d537732dc8fb
-
SHA1
339657894338cfa9ee994e440443d4fc7ef75368
-
SHA256
860bb4fd3607ebdb177d9732653f9baeff86192cdf7874c5824ab37b9b61013d
-
SHA512
562e31c22abf83d57785a5506025847e18a652765f4086ebc1c199b751eeb184a85e9d0ec08289fea1b6beeda0b94e2195a46702aa643ba4f3558a4023af2268
-
SSDEEP
24576:OkCIwKMTJndSh1pBOjgqDx/u09mNfRWqERWsyI7RHc+Ow57pca5eBZq7W71p0Z3a:OkCzgEHDafT2bW+OwcMeTq72LU
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sihost.exe"C:\Users\Admin\AppData\Local\Temp\sihost.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\\ProgramData\\2008.cmd2⤵
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o3⤵
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "3⤵
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\\ProgramData\\24970.cmd2⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\\ProgramData\\702.cmd2⤵
-
-
C:\Windows\SysWOW64\recover.exeC:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\dbwssyraepvd"2⤵
-
-
C:\Windows\SysWOW64\recover.exeC:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\dbwssyraepvd"2⤵
-
-
C:\Windows\SysWOW64\recover.exeC:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\fvbltjkcaxnhqupx"2⤵
-
-
C:\Windows\SysWOW64\recover.exeC:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\qqgvubvvoffusalbjms"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD51df650cca01129127d30063634ab5c03
SHA1bc7172dec0b12b05f2247bd5e17751eb33474d4e
SHA256edd4094e7a82a6ff8be65d6b075e9513bd15a6b74f8032b5c10ce18f7191fa60
SHA5120bddf9ecaaedb0c30103a1fbfb644d6d4f7608bd596403307ed89b2390568c3a29e2cf55d10e2eadbfc407ede52eaf9a4f2321ba5f37e358a1039f73c7688fbd
-
Filesize
2KB
MD59a020804eba1ffac2928d7c795144bbf
SHA161fdc4135afdc99e106912aeafeac9c8a967becc
SHA256a86c6c7a2bf9e12c45275a5e7ebebd5e6d2ba302fe0a12600b7c9fdf283d9e63
SHA51242f6d754f1bdbeb6e4cc7aeb57ff4c4d126944f950d260a0839911e576ad16002c16122f81c1d39fa529432dca0a48c9acfbb18804ca9044425c8e424a5518be
-
Filesize
4KB
MD58c7026b1782eb70d9339c3525a05528b
SHA19087399b2f863d19157a45702c66932a0d028211
SHA256c9ccfd99d8866661dcc1e1cfcd01619d12ac835db6f2859e1aa4d873b6996622
SHA51252b94ef24556888cab372bb5f8510ef849a39228f627a61a75a3e11ce8c55b205d348d340881da9cd0bab41218831a285b6ba50cfc7e4851d57efe85d7ebdf8c
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
1.6MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB