modiloader | 3a07d1cbc8052ba733faaacff6b69858057ad8efc52583a78fcd98f6e96be88f

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26/04/2022, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7ffeab886ec1a557ca7568849145296.exe
Size 724KB
Sample220426-fehp4sbad4
SHA256 3a07d1cbc8052ba733faaacff6b69858057ad8efc52583a78fcd98f6e96be88f
MD5 b7ffeab886ec1a557ca7568849145296
SHA1 c7d609c06464dda847a0bc4d1c73c9199905107f
SHA512 69047eeb144a9226226329c01f931635a469ec144f66d3d73596745038fa1656c5476cbd12cd294e4fb9eaf586d2cbb08f5732c4599d064b9818beda2948ed29
MD5 SHA1 SHA512

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 39 IoCs

resource	yara_rule
behavioral2/memory/2104-140-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-141-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-142-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-143-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-144-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-145-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-146-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-147-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-148-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-149-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-150-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-151-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-152-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-153-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-154-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-155-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-156-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-157-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-158-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-159-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-160-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-161-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-162-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-164-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-163-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-165-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-167-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-168-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-169-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-170-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-171-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-178-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-179-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-180-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-181-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-182-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-183-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-186-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2
behavioral2/memory/2104-184-0x0000000003960000-0x00000000039B0000-memory.dmp	modiloader_stage2

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3052	4576	WerFault.exe	88
1700	4576	WerFault.exe	88

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88
PID 2104 wrote to memory of 4576	2104	b7ffeab886ec1a557ca7568849145296.exe	88

C:\Users\Admin\AppData\Local\Temp\b7ffeab886ec1a557ca7568849145296.exe
"C:\Users\Admin\AppData\Local\Temp\b7ffeab886ec1a557ca7568849145296.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\DpiScaling.exe
  C:\Windows\System32\DpiScaling.exe
  2⤵
  PID:4576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 780
    3⤵
    - Program crash
    PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 824
    3⤵
    - Program crash
    PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4576 -ip 4576
1⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4576 -ip 4576
1⤵
PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-160-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-161-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-142-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-143-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-144-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-145-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-146-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-147-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-148-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-149-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-150-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-151-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-152-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-153-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-154-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-155-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-156-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-157-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-158-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-159-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-141-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-162-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-140-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-164-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-163-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-165-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-184-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-167-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-168-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-169-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-170-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-171-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-178-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-179-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-180-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-181-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-182-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-183-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/2104-186-0x0000000003960000-0x00000000039B0000-memory.dmp

Download

memory/4576-185-0x0000000010410000-0x000000001043B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads