modiloader | f7e3e71f6386c5399291e127994d04abd5634ae8723a32f96db525e9f2150b80 | Triage

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2022 18:07

Sharing

Report Analysis Logs

General

Target

f7e3e71f6386c5399291e127994d04abd5634ae8723a32f96db525e9f2150b80.exe
Size

1.1MB
MD5

a53ef40486536c8aab95779bd4eb79f4
SHA1

4035c5ae014e2237e12a8b8170129e5cd2297b91
SHA256

f7e3e71f6386c5399291e127994d04abd5634ae8723a32f96db525e9f2150b80
SHA512

87cd12aaa4bfbe50d79c2ee065ff3fe3eb6ed39591f7d6d3321ae01f1514598f65ffb499e863fae1bca9bd321c3979dcdb0922093bd1c9615ff427bfd9fcb324

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3248-131-0x00000000031E0000-0x00000000031F0000-memory.dmp	modiloader_stage1

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4844 3136 WerFault.exe
4380 3248 WerFault.exe f7e3e71f6386c5399291e127994d04abd5634ae8723a32f96db525e9f2150b80.exe

C:\Users\Admin\AppData\Local\Temp\f7e3e71f6386c5399291e127994d04abd5634ae8723a32f96db525e9f2150b80.exe
"C:\Users\Admin\AppData\Local\Temp\f7e3e71f6386c5399291e127994d04abd5634ae8723a32f96db525e9f2150b80.exe"
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1488
2⤵
- Program crash
PID:4380

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 3136 -ip 3136
1⤵
PID:4172

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3136 -s 1772
1⤵
- Program crash
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3248 -ip 3248
1⤵
PID:4368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3248-131-0x00000000031E0000-0x00000000031F0000-memory.dmp

Filesize
64KB

Download