modiloader | cafb7d353313362efa3d09e9a4345c681bba522185870ceb930216d54ffe00c8 | Triage

Analysis

max time kernel
143s
max time network
157s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
31-10-2022 19:11

Sharing

Report Analysis Logs

General

Target

Retefpaddbhtal.exe
Size

733KB
MD5

4f7199a3cf8228b7a1ea06157e033f1f
SHA1

9c3dc25dc1baf8bea180d0ef6cdc7ecc19de3b5d
SHA256

cafb7d353313362efa3d09e9a4345c681bba522185870ceb930216d54ffe00c8
SHA512

3be7a80b373c81fc16637ad99ec84d185c3e2bb3e60c540f0dd60fbe1c85407caaf1ec2993a1114856a466fdb3763132e5d501bb5d8f16c179bad91322294d7e
SSDEEP

12288:vE8us5hZIRFFRs4nmHQqtZua/3RvWEmhj+wzhd:MJ8ZIRFFRPnmDzuUmYYh

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1380-55-0x0000000000550000-0x000000000057B000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\Retefpaddbhtal.exe
"C:\Users\Admin\AppData\Local\Temp\Retefpaddbhtal.exe"
1⤵
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1380-55-0x0000000000550000-0x000000000057B000-memory.dmp

Filesize
172KB

Download