modiloader | e62a8dd12a0fe7876f858f80bfc1e9658f52f4594d7194ecc6dd656cd715b9d4 | Triage

Analysis

max time kernel
131s
max time network
145s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-02-2023 07:07

Sharing

Report Analysis Logs

General

Target

0094352783923.exe
Size

726KB
MD5

74d4c55aec897f408948b8a5609bffdd
SHA1

7fa4f6619edac4852b0eec9d017c5d68218d3c3d
SHA256

e62a8dd12a0fe7876f858f80bfc1e9658f52f4594d7194ecc6dd656cd715b9d4
SHA512

b8500b56c2be340d20d3d6f9442dc697e1bde8b61b15d0e4c30fe616d92576391517bb71411a0929501aa1b5486dcf8083782f6ffa239ebf2cb28f472ea25665
SSDEEP

12288:4ElN2Z2/NeCH8l5Hcy+Kl6ZZw773v8kOAAlD+JuvoMAEulyZZI9:F6YoCc0y+KlGwn35vAl5lAEuoLI9

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-55-0x00000000002D0000-0x00000000002FC000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\0094352783923.exe
"C:\Users\Admin\AppData\Local\Temp\0094352783923.exe"
1⤵
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x00000000002D0000-0x00000000002FC000-memory.dmp

Filesize
176KB

Download