modiloader | 1da54f988f7f2f0cd26976fbaa87f3f6064b5c72d2e02607912baad5da5b7ef7 | Triage

Analysis

max time kernel
131s
max time network
146s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-02-2023 15:38

Sharing

Report Analysis Logs

General

Target

Pdygfcjfevthba.exe
Size

884KB
MD5

054d3ce0c0c82f28547112a82f8ea692
SHA1

8c088a60d8f7e66261cca8d4ccb384ea1d9ad2c4
SHA256

591ea8c06daef587f239bbaa3d29cb46ccba25ccba58c324441efbaf4c5eb5d8
SHA512

45978b98a401d90be5c0db269fb52abc11a185b2a0e68eafa1d4b6ecf830944b53d6d166fd8bee5b28088d48c2b521ad3968f4569025817fd67a88967c87aeab
SSDEEP

12288:Cb8A+lyMML0gN55kXFyqf0bGBvGoE3IhAf1nAhglR:C4ZzML0gN5WXFaK9GoEHf1nAhglR

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/988-55-0x00000000006B0000-0x00000000006DC000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\Pdygfcjfevthba.exe
"C:\Users\Admin\AppData\Local\Temp\Pdygfcjfevthba.exe"
1⤵
PID:988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/988-55-0x00000000006B0000-0x00000000006DC000-memory.dmp

Filesize
176KB

Download