modiloader | 47362bdf98d40124a5be66bb91e83584bb8a1d9ce57e830ff44016268f468e3f | Triage™

Analysis

max time kernel
143s
max time network
36s
platform
windows7_x64
resource
win7v20201028
submitted
20/12/2020, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e19a67563628389a2e10b449744c1547.exe
Size 1.1MB
Sample201220-qb947t5cex
SHA256 47362bdf98d40124a5be66bb91e83584bb8a1d9ce57e830ff44016268f468e3f
MD5 e19a67563628389a2e10b449744c1547
SHA1 fc1a245c5edd9e3dc3f140c744017464cefeb70b
SHA512 2cae72ad25db935d2099fe5bdfb2359a5d9c499cf4934c2e6158baeb39971fa43f063c79a2fa7d3d5423d3928384b7b52be5607f07dba992a4d4059438efedd3
MD5 SHA1 SHA512

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1068-2-0x0000000002C00000-0x0000000002C76000-memory.dmp	modiloader_stage1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1068	e19a67563628389a2e10b449744c1547.exe

C:\Users\Admin\AppData\Local\Temp\e19a67563628389a2e10b449744c1547.exe
"C:\Users\Admin\AppData\Local\Temp\e19a67563628389a2e10b449744c1547.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-2-0x0000000002C00000-0x0000000002C76000-memory.dmp

Download