modiloader | 2688204813e40e64d5451b87d7028267200caba846773f6b115c3d1dbc675032 | Triage

Analysis

max time kernel
131s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-01-2023 18:14

Sharing

Report Analysis Logs

General

Target

wbhmdn.exe
Size

753KB
MD5

6d5e7540cc8cb9593f0b0d355b7275a4
SHA1

dffcef6fbf66c16558c8a7fef4d8bc49fcbe224e
SHA256

2688204813e40e64d5451b87d7028267200caba846773f6b115c3d1dbc675032
SHA512

732ae3cde7dd5cfe36f2252232f8d36c918f84481a5cce467fbc676c60cb83c4cf863d88e0de62c58b6ca7723095f2c77cf51f811078490323bac871a52288d6
SSDEEP

12288:NRF268BfCbyuSwcLzXr0cyRmRxW0FPAQMIY5GCIdXKh1uFNuv:fE7CbR9cvoRoxfasY9qQuHuv

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/880-55-0x0000000000300000-0x000000000032F000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\wbhmdn.exe
"C:\Users\Admin\AppData\Local\Temp\wbhmdn.exe"
1⤵
PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/880-55-0x0000000000300000-0x000000000032F000-memory.dmp

Filesize
188KB

Download