modiloader | a78e89ef2769dd705ce27a6b5876ca2fdc5a5aa078ff9a4d86f186d4bb6edce8

Analysis

Target
Amxoarzogpggeozursulwknspwqbfjgqxt.exe
Size 772KB
Sample211210-pnbslagdc6
SHA256 a78e89ef2769dd705ce27a6b5876ca2fdc5a5aa078ff9a4d86f186d4bb6edce8
MD5 3a45e8bcd4b88361149a10abedad392f
SHA1 dc7f8b6d6b9e2b332aca78fdd899f96baf7debc8
SHA512 8ed90a69ff6d51dd7c884d1992afc05368181cf853780fa119b78b7222f3a264f3e0f8195599d5b8283797577d77b9900025a3d099468887798d693e7f651e6a
MD5 SHA1 SHA512

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2736-118-0x00000000027D1000-0x00000000027E5000-memory.dmp	modiloader_stage1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3388	2736	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\Amxoarzogpggeozursulwknspwqbfjgqxt.exe
"C:\Users\Admin\AppData\Local\Temp\Amxoarzogpggeozursulwknspwqbfjgqxt.exe"
1⤵
PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1892
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3388

memory/2736-118-0x00000000027D1000-0x00000000027E5000-memory.dmp

Download

memory/2736-119-0x0000000002740000-0x0000000002741000-memory.dmp

Download