modiloader | 21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6

Analysis

Target

21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6.exe
Size

1.0MB
MD5

6adcba88a16f508ec905410cbb050894
SHA1

d56cf76e5dac45f67a4e20e6a5b5b909d0f81b7d
SHA256

21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6
SHA512

b0d6058716d4bf1f9b82a80cf53f3663848a1a984b2509807606b932d47f584eb7e20064328e287eff1a906e3cd9e8fe1b9b95089a8ad7d38217e07370a7e4df

Score

10^/10

modiloader trojan

Family

modiloader

https://cdn.discordapp.com/attachments/762895490362638339/771585630530306059/Swdlert

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4924-131-0x0000000004680000-0x0000000004690000-memory.dmp	modiloader_stage1
behavioral2/memory/4924-138-0x00000000031F0000-0x0000000003200000-memory.dmp	modiloader_stage1

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1468 4924 WerFault.exe 21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6.exe

pid	pid_target	process	target process
1468	4924	WerFault.exe	21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6.exe

C:\Users\Admin\AppData\Local\Temp\21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6.exe
"C:\Users\Admin\AppData\Local\Temp\21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6.exe"
1⤵
PID:4924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 1776
  2⤵
  - Program crash
  PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4924 -ip 4924
1⤵
PID:4504

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/4924-131-0x0000000004680000-0x0000000004690000-memory.dmp

Filesize
64KB

Download
memory/4924-138-0x00000000031F0000-0x0000000003200000-memory.dmp

Filesize
64KB

Download