modiloader | f94f0d8034aad730d9cd2aad3940f5f94d85deb0615d1263ea3f3d54e8fc21f1

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 07:02

Target

f94f0d8034aad730d9cd2aad3940f5f94d85deb0615d1263ea3f3d54e8fc21f1.exe
Size

867KB
MD5

2a2321265518788b819541ca902cd9f5
SHA1

9a4f897f9566918c6dd30d0fbad4a01c62f20eec
SHA256

f94f0d8034aad730d9cd2aad3940f5f94d85deb0615d1263ea3f3d54e8fc21f1
SHA512

6d2f8d2de4a44ea7d73ca6f37d857241fced415d73fe30d5a339f6603b4a949bf4b9c72cd7f6cade11a917d7611a1294e171114140e6af2578da7b98575b58a4
SSDEEP

24576:HnxDTkCKEImf6tJ9PjKodO3ZCqYcYYZVky9:HZOE8/PjKVJCqkYQy9

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3916-132-0x0000000000010000-0x00000000001CBA1C-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2200 3916 WerFault.exe f94f0d8034aad730d9cd2aad3940f5f94d85deb0615d1263ea3f3d54e8fc21f1.exe

pid	pid_target	process	target process
2200	3916	WerFault.exe	f94f0d8034aad730d9cd2aad3940f5f94d85deb0615d1263ea3f3d54e8fc21f1.exe

C:\Users\Admin\AppData\Local\Temp\f94f0d8034aad730d9cd2aad3940f5f94d85deb0615d1263ea3f3d54e8fc21f1.exe
"C:\Users\Admin\AppData\Local\Temp\f94f0d8034aad730d9cd2aad3940f5f94d85deb0615d1263ea3f3d54e8fc21f1.exe"
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 440
2⤵
- Program crash
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3916 -ip 3916
1⤵
PID:1624

memory/3916-132-0x0000000000010000-0x00000000001CBA1C-memory.dmp

Filesize
1.7MB

Download