Overview

overview

10

Static

static

21ff3661fd...e6.exe

windows7_x64

10

21ff3661fd...e6.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-04-2022 04:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6.exe

  • Size

    1.0MB

  • MD5

    6adcba88a16f508ec905410cbb050894

  • SHA1

    d56cf76e5dac45f67a4e20e6a5b5b909d0f81b7d

  • SHA256

    21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6

  • SHA512

    b0d6058716d4bf1f9b82a80cf53f3663848a1a984b2509807606b932d47f584eb7e20064328e287eff1a906e3cd9e8fe1b9b95089a8ad7d38217e07370a7e4df

Score
10/10
modiloadertrojan

Malware Config

Extracted

Family

modiloader

C2

https://cdn.discordapp.com/attachments/762895490362638339/771585630530306059/Swdlert

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader First Stage 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6.exe
    "C:\Users\Admin\AppData\Local\Temp\21ff3661fd96f689aa32338ca899eef0afdc23f509bf29cbb85ad6da5f7bcee6.exe"
    1⤵
      PID:4924
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 1776
        2⤵
        • Program crash
        PID:1468
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4924 -ip 4924
      1⤵
        PID:4504

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Web Service

      1
      T1102

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4924-131-0x0000000004680000-0x0000000004690000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4924-138-0x00000000031F0000-0x0000000003200000-memory.dmp
        Filesize

        64KB

        Download