modiloader | 6b2971adf8a8fec695148d935e5ec1e80042fb2058e9b633f63d293eecd3116f

Analysis

max time kernel
169s
max time network
184s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b2971adf8a8fec695148d935e5ec1e80042fb2058e9b633f63d293eecd3116f.exe
Size

1007KB
MD5

7e5cf5a34cc69661e50e4909cacce802
SHA1

421e5c07b63f7d8db5fd70cbe2c144813abbe7e1
SHA256

6b2971adf8a8fec695148d935e5ec1e80042fb2058e9b633f63d293eecd3116f
SHA512

f04018b343b9be9bb7780081cf1dfe6f61e084d48bf9f7c25140870ce730106417059090835a31c97f4cc26eab9bc1162e6ec41b25fe507e1ba778ce071a9ef4
SSDEEP

12288:fMrKprISPxdtyWrV3vneDB5JkTEp9ybqTiQJ5KT7grzwGjReiOXRDJymf7fvO:fMmljztfw+woiiqPheiOXRDDvO

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 43 IoCs

resource	yara_rule
behavioral1/memory/1640-56-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-58-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-57-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-59-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-60-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-61-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-62-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-63-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-64-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-65-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-66-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-68-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-67-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-69-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-70-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-71-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-72-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-73-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-74-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-75-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-76-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-77-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-78-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-79-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-80-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-81-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-82-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-83-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-85-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-86-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-84-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-87-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-89-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-88-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-90-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-91-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-92-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-93-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-94-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-95-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-96-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-97-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2
behavioral1/memory/1640-98-0x0000000001FE0000-0x0000000002031000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\6b2971adf8a8fec695148d935e5ec1e80042fb2058e9b633f63d293eecd3116f.exe
"C:\Users\Admin\AppData\Local\Temp\6b2971adf8a8fec695148d935e5ec1e80042fb2058e9b633f63d293eecd3116f.exe"
1⤵
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1640-56-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-58-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-57-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-59-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-60-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-61-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-62-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-63-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-64-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-65-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-66-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-68-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-67-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-69-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-70-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-71-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-72-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-73-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-74-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-75-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-76-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-77-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-78-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-79-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-80-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-81-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-82-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-83-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-85-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-86-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-84-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-87-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-89-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-88-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-90-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-91-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-92-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-93-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-94-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-95-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-96-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-97-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download
memory/1640-98-0x0000000001FE0000-0x0000000002031000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads