modiloader | e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 11:58

Target

e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe
Size

111KB
MD5

19afdf4e606d1833a1f8586806c1e298
SHA1

e31bc76f044917eaa6bd83ce48833cde2012ffcf
SHA256

e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783
SHA512

3c0d64454a99a7d7ab8db9b39d7181b286a4c8bffe080bd8191c00e04ba575e75387799365ecb4dd961ed934030be00b94cd94d6d8febc62decca51ad4b5ba61
SSDEEP

3072:S1+MJKrUnFYY5z7i0Nmbi5fJBNPhkout:SIrP90NmWtNyoS

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4512-133-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4512-132-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/4512-133-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5112 4512 WerFault.exe e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe

pid	pid_target	process	target process
5112	4512	WerFault.exe	e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe

C:\Users\Admin\AppData\Local\Temp\e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe
"C:\Users\Admin\AppData\Local\Temp\e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe"
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 488
2⤵
- Program crash
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4512 -ip 4512
1⤵
PID:2576

memory/4512-132-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4512-133-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download