modiloader | a644f4644a53319c1acefcd761d046e98a480f291ac0649f540a80dab570a237

Analysis

max time kernel
163s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a644f4644a53319c1acefcd761d046e98a480f291ac0649f540a80dab570a237.exe
Size

380KB
MD5

1ab27b63c1a49193f4b2f1f9554ca91b
SHA1

a746201024f0cd21e1d10f4d435510e3f4de33d2
SHA256

a644f4644a53319c1acefcd761d046e98a480f291ac0649f540a80dab570a237
SHA512

03d41630e4d4cae5058ad3e9080e53e1657c1f1bae2503410551656cbc1e575b06f8828189ead40e1f96eb7a85bb5e292f2ebea952cc362a7ef6c61d7c2a9af5
SSDEEP

6144:Hk8u7jp9fQ6u+JUuWj2bL30ct3PUgXjgc/kS8vyiYESWT5kLo8Xb0FAFnQslaHu3:UplTUJ2bLkct3s1c/kS8vyiYMT5kLoWt

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/2532-133-0x0000000000400000-0x0000000000482000-memory.dmp	modiloader_stage2
behavioral2/memory/2532-136-0x0000000000400000-0x0000000000482000-memory.dmp	modiloader_stage2
behavioral2/memory/2532-137-0x0000000000400000-0x0000000000482000-memory.dmp	modiloader_stage2

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a644f4644a53319c1acefcd761d046e98a480f291ac0649f540a80dab570a237.exe
"C:\Users\Admin\AppData\Local\Temp\a644f4644a53319c1acefcd761d046e98a480f291ac0649f540a80dab570a237.exe"
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-132-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2532-133-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2532-134-0x0000000000620000-0x0000000000624000-memory.dmp

Filesize
16KB

Download
memory/2532-135-0x0000000000660000-0x0000000000699000-memory.dmp

Filesize
228KB

Download
memory/2532-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2532-137-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2532-138-0x0000000000660000-0x0000000000699000-memory.dmp

Filesize
228KB

Download