modiloader | acc57e05862b1b5eb0097458eee2a1c77cf74b7136a70b082ede6affee1e52c9

Analysis

max time kernel
105s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2023 12:37

Target

acc57e05862b1b5eb0097458eee2a1c77cf74b7136a70b082ede6affee1e52c9.exe
Size

946KB
MD5

67fbce58396e7744b82dc5c7a19218cd
SHA1

b77b8522ac84bb6078b3244ea0d153bb58ddebcd
SHA256

acc57e05862b1b5eb0097458eee2a1c77cf74b7136a70b082ede6affee1e52c9
SHA512

250410149ec9f93329dda9333696594b34c0b92fab1b3132862eb540cacf4025cb59365679a32ec6918ce732d3737ede022ebf748053f3350b3bc2f401a6ac9a
SSDEEP

12288:cYcH/Ym8m40U1g6LfYdOKMhhLm733R3VoctIRy3+AhSsKySOVgA0klqUk1:cRgkwg6LfYdShiDtuUP3l75Shklq

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1876-133-0x00000000027A0000-0x00000000027CC000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2692 1876 WerFault.exe acc57e05862b1b5eb0097458eee2a1c77cf74b7136a70b082ede6affee1e52c9.exe

pid	pid_target	process	target process
2692	1876	WerFault.exe	acc57e05862b1b5eb0097458eee2a1c77cf74b7136a70b082ede6affee1e52c9.exe

C:\Users\Admin\AppData\Local\Temp\acc57e05862b1b5eb0097458eee2a1c77cf74b7136a70b082ede6affee1e52c9.exe
"C:\Users\Admin\AppData\Local\Temp\acc57e05862b1b5eb0097458eee2a1c77cf74b7136a70b082ede6affee1e52c9.exe"
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 1928
2⤵
- Program crash
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1876 -ip 1876
1⤵
PID:4672

memory/1876-133-0x00000000027A0000-0x00000000027CC000-memory.dmp

Filesize
176KB

Download
memory/1876-135-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/1876-136-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download