MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a91675248e7d9891570e731b1dce694054d9db90f14bb4a74d5a9fd571af758. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a91675248e7d9891570e731b1dce694054d9db90f14bb4a74d5a9fd571af758
SHA3-384 hash: 37dc929803334a037b36bc03b2f5b15e022dfcb0e47bf0bf5200c7aaf3c9fcf2b74ae6d1ddd0d12d1467b9be973e492d
SHA1 hash: fbfccfd93b7bdab3571e72b9263223a1d9937478
MD5 hash: d2aa5f49dafd0b160aaee0d2e47cb1ad
humanhash: carolina-paris-massachusetts-blossom
File name:Delivery Confirmation.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:768'000 bytes
First seen:2023-01-02 11:06:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ba06c2597137184f96c414823601d826 (2 x ModiLoader)
ssdeep 12288:v17Wp3CWCsPd7ZJfVnbHKXU5OSaHJ4hwcDaJ7zvzF1Ez21AcjBg9LTU:dS5AsPd7ZJ9nbuUQSap4TD6rjEzVT
Threatray 17'942 similar samples on MalwareBazaar
TLSH T1ADF48E63A1923737D1721B784CF6973814EB3E703D38A486A688BD4A6F362D5242F177
TrID 28.1% (.EXE) Win32 Executable Delphi generic (14182/79/4)
25.9% (.SCR) Windows screen saver (13097/50/3)
20.8% (.EXE) Win64 Executable (generic) (10523/12/4)
8.9% (.EXE) Win32 Executable (generic) (4505/5/1)
4.1% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 8aa2b6b2aaaad4d4 (3 x RemcosRAT, 2 x ModiLoader, 1 x Loki)
Reporter Anonymous
Tags:DHL exe ModiLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
PL PL
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Delivery Confirmation.exe
Verdict:
Malicious activity
Analysis date:
2022-12-22 16:38:07 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/fbad3a99-0c70-46c8-957f-8c9295244afe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.DropperX-gen.10660.14046.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Launching a process
Creating a process with a hidden window
Searching for the window
Launching cmd.exe command interpreter
Reading critical registry keys
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
keylogger overlay remcos
Link:
https://www.filescan.io/uploads/63b2bad7dde391056ac0dffe/reports/6e61d97b-4e24-42bb-8d7e-0e9aa79117bd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ceb4bcb6-0f64-499c-8fca-56202c658f1e
Result
Threat name:
DBatLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1144123
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected DBatLoader
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 776853 Sample: Delivery Confirmation.exe Startdate: 02/01/2023 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 3 other signatures 2->41 9 Delivery Confirmation.exe 1 18 2->9         started        process3 dnsIp4 33 oreareu.tk 103.83.194.19, 443, 49696 NETWORK-LEAPSWITCH-INLeapSwitchNetworksPvtLtdIN United States 9->33 29 C:\Users\Public\Libraries\Mqmvancj.exe, PE32 9->29 dropped 31 C:\Users\...\Mqmvancj.exe:Zone.Identifier, ASCII 9->31 dropped 57 Writes to foreign memory regions 9->57 59 Allocates memory in foreign processes 9->59 61 Creates a thread in another existing process (thread injection) 9->61 63 Injects a PE file into a foreign processes 9->63 14 wscript.exe 9->14         started        file5 signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 14->65 67 Maps a DLL or memory area into another process 14->67 69 WScript reads language and country specific registry keys (likely country aware script) 14->69 71 Queues an APC in another process (thread injection) 14->71 17 explorer.exe 4 2 14->17 injected process9 process10 19 Mqmvancj.exe 17->19         started        22 msiexec.exe 17->22         started        24 wscript.exe 17->24         started        signatures11 43 Multi AV Scanner detection for dropped file 19->43 45 Writes to foreign memory regions 19->45 47 Allocates memory in foreign processes 19->47 49 2 other signatures 19->49 26 colorcpl.exe 2 19->26         started        process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 26->51 53 Maps a DLL or memory area into another process 26->53 55 Sample uses process hollowing technique 26->55
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a91675248e7d9891570e731b1dce694054d9db90f14bb4a74d5a9fd571af758/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-12-21 09:52:46 UTC
File Type:
PE (Exe)
Extracted files:
50
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkiwousi47mysflq44y3dxhgsqcu3hnzb4klwstu2wu72vy265ma._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
02811c0c7eed997879c5c54e2b8ac6bd2e0ef9aee0df3ab0ff7273e6234010fa
ModiLoader
68484d62dab0f69fe93fad1f2bb08a0284426ee328efc38b6000f54acf5945f1
ModiLoader
82dab0084009dd05a0beee74a261131edf8ebe11a9a4e3988ac37fe58656511b
ModiLoader
8a93dabd3dda5548c792f3064979a25a5770e5870a8d9989a0b16b5f2cc56204
ModiLoader
9998ff1d42d8af0fcc166bea36887eebf182e91d1816853d9f80e6cbbbaf9145
ModiLoader
9dc2a5da6e549eff0358485278342915ecec6ef3d666a1234e6595163cbc6f60
ModiLoader
a7537f2ef1d10ef549145bd8ce586f1cce82ed841eda60b991b01137bd558bab
ModiLoader
c424a21abb01f466b5a9e3ef4b29e33c3cd1419f69e0f8b0a7787bf40ab75271
ModiLoader
df240dd59b12cc79fd1afcbae82d36ba57cff186f18991a69fd42d1ef4639208
ModiLoader
dfef95aace8bc4b84638abf73bdfb24e3108f8fef08ad6129546a2ffe9c13341
ModiLoader
+ 17'932 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader persistence trojan
Link:
https://tria.ge/reports/230102-m7zbwsea25/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
ModiLoader Second Stage
ModiLoader, DBatLoader
Unpacked files
SH256 hash:
5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693
MD5 hash:
ee94f46ed9b387ad243c36c1cb062686
SHA1 hash:
6e0c4dc795dec2dce9454fbb246afabffd2039fc
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/aba73fb3-6192-4c7b-8e2f-47bef3364816/
Parent samples :
4ef967caea627a1b9cd7f74d31584b69d76f8c532cee528e8815c4f70ae24aa7
dc35d3d87c8f062b000472a46ec166c5bf8f399f95c02717eab4ce542043afd7
bb01ebad742a61a5aee09777d88a01e627d29171513c335f52c57c41c7e41ef4
0dec26f0ed31eafa41f5141a4342f84f5245ba6d097904ed1fdb11a6df1ce606
c2c6eec67a1561c3a49179ddf756480876d92588c2e83d64246a04c3d724cb3d
f53107b892a50e33ff130e01cf391a2b69524dbe09b75cc13192365bbd6eda11
9c9b7deb6e3b6b7154fb858a101eb57d65b57e364840213823ce5c8e0be1653e
109ab3837f865b4ba288ca4a1fa4e8d416c04b3686376c55128553d4a4db55b5
1fdbc93a0a891ff9ca424bb90bd696140b5918583ad6e0f2fcce012640cde8dd
230b07866371131de12907f26f06a9cfa27762c499f93cae840c198ea9e46846
494e56903190304bab1c27786bd1f60aeaede9b478b2bca17474602414b82688
db399100d63fa87dbc5d6596d2c44749c0cee86ea45d7e81206277c9cdacb9f1
16ba74e590acbf2a285ae1e15864ef7cdeff576542f0f430ab83481ea52b729a
ffa9f3d0e3d4d29b10cba30fe3394d538b8c415e9c29cf36a56990e9204ec7bf
0305b3a95aff122c888a200de747a565208ea19494c8257b0c972084141f42c4
c84d9cb4b4e037cbaf9632d4cdd0f493d2c5e0b5f6308fe97f84f04b501155c8
a9da7b242be8ba00f35c48183b953f5e792c948a57ed1043f6759a5b61f19d70
e7298f63b0ee46b470e6c7323087e2af9fe4802ed93674d1408f10d03989a7f6
e6303d0730eaecd16e8a3becf77fce3d5da13155d2e27e102ecc2b700ad42814
105ffb0a1b83441a798498a4b1a535fce7f496304b39bd555f18df3678f19c13
ca13eac154ad479e2234deac0f07989db25e4d50c47cdc7f4f31dd7ab71dc087
03daa8dcea75f814b344785dc1f52222cd4461bccc17a35f032efe81e47d18be
6246a9212db799df597fe34bcbeeeb08dad116b7cf3cd4c8037d42d1d0b4256a
aaa28e71ec8aad860fdc9f517c151b85be433e142160341f2aa399d9c60d11cf
f974cf4bda9a65b7a2573726e3808c696f6a5e54b89f08807764d9ab2a06a5c1
b8002e076820615fe2b14369e7d258ff2984cd832a38de4f1450b84813b283c5
de8c5c01bab7e747f3cd3f276d7cf3c839600131987cbcfcd5314f9af6d64b05
7cec52ddbd0c2037de1b4ad9eedcbedbfc005cb558c7f326dcf66c800e7875f1
91dd17921c69af057a78759611885bb04ebc68a9ec38ca08067c496f9e76a241
b0d85d76e52034986c3d4e165a745c04b3af21d1c5692719d1b66bceafc76423
af5ecbd67c2195a72178b6b0a886715d4b28fd064717dd3193a477563c5be6b6
7a91675248e7d9891570e731b1dce694054d9db90f14bb4a74d5a9fd571af758
878257b5d411ceedf80fcab13183bd22ea6183a86c8d5a99a7ff08dd01567fc0
c4cd277e81aec420cdf23a0d5ebff50b0d64dd9c6b3b1942567c263032f64deb
SH256 hash:
7a91675248e7d9891570e731b1dce694054d9db90f14bb4a74d5a9fd571af758
MD5 hash:
d2aa5f49dafd0b160aaee0d2e47cb1ad
SHA1 hash:
fbfccfd93b7bdab3571e72b9263223a1d9937478
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/aba73fb3-6192-4c7b-8e2f-47bef3364816/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7a91675248e7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/7a91675248e7d9891570e731b1dce694054d9db90f14bb4a74d5a9fd571af758

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments