modiloader | d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89

Analysis

max time kernel
145s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 12:32

Target

d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe
Size

111KB
MD5

51882ee01db9282a25820b10c5618dea
SHA1

6f5a36a49650576e03bd03efcc849574e05bb06b
SHA256

d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89
SHA512

c5ab9e106b729fbda6351ee45e1d4168efb379c93351fd7cdfc953688c4f9a9aaf90d9dc69bfa55ba65b2675e1d4cb279cd079979709ce41003ff1455c4b11d3
SSDEEP

3072:91+MJKrUnFYY5z1i0Nmbi5f/BNPhkout:LIrPj0NmWTNyoS

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1408-133-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1408-132-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1408-133-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4964 1408 WerFault.exe d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe

pid	pid_target	process	target process
4964	1408	WerFault.exe	d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe

C:\Users\Admin\AppData\Local\Temp\d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe
"C:\Users\Admin\AppData\Local\Temp\d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe"
1⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 488
2⤵
- Program crash
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1408 -ip 1408
1⤵
PID:2740

memory/1408-132-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1408-133-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download