Overview

overview

10

Static

static

10

Trojan.Win...3d.exe

windows7-x64

10

Trojan.Win...3d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    87s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-03-2023 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan.Win32.Kovter.ajre-dd06fe981c4c4f544efca799ff968f022e1172ed2bb545bf3de1a7cbdcba3f3d.exe

  • Size

    396KB

  • MD5

    63f354e790330913b6ec49a3fd6609ef

  • SHA1

    7d5409cdbfb89091a7b0bb5733295980d927a66e

  • SHA256

    dd06fe981c4c4f544efca799ff968f022e1172ed2bb545bf3de1a7cbdcba3f3d

  • SHA512

    45b1fd1d80f83efa0abbbc18f3c0adcb5a83d7d20299f0a27501d23493e677019a25a2ad19e5f40159f3a876867dba5f451944ae450a1e9b518ffae0ce9f3f27

  • SSDEEP

    6144:5E9yDzN5oqKVsJAC328uO6s1wQW877buWxjy/qj+aA/H4:OEDJ5ofs9BuOB1wQW87XuWxM

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 1 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Kovter.ajre-dd06fe981c4c4f544efca799ff968f022e1172ed2bb545bf3de1a7cbdcba3f3d.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Kovter.ajre-dd06fe981c4c4f544efca799ff968f022e1172ed2bb545bf3de1a7cbdcba3f3d.exe"
    1⤵
      PID:3736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 496
        2⤵
        • Program crash
        PID:3420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3736 -ip 3736
      1⤵
        PID:3764

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3736-133-0x00000000063C0000-0x0000000006428000-memory.dmp
        Filesize

        416KB

        Download