modiloader | 135950b42dd73dbe351f5c677d8485c1bf4f0a0dafae8565301a069fad1db1da | Triage

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 11:55

Sharing

Report Analysis Logs

General

Target

dd135d51b98178b15d4111001131f91a.exe
Size

1.0MB
MD5

dd135d51b98178b15d4111001131f91a
SHA1

62757575a10f8a906bac8a2b7b68e855b6d2231a
SHA256

135950b42dd73dbe351f5c677d8485c1bf4f0a0dafae8565301a069fad1db1da
SHA512

dad2b669ba49ce29eebeed91d066a35d3b3047e4176b21f58ba7a8993cf76b2d11cb1d93b4ff074567cee9dfb6d2a7766d33ad358f22fbd7db7044decaa092c1
SSDEEP

24576:WppGPEbmkx2lp2w4FvR93i2O+U1xldqu/T2SA:WppGscYFP9F

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4928-133-0x0000000002D20000-0x0000000002D4C000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4744 4928 WerFault.exe dd135d51b98178b15d4111001131f91a.exe

C:\Users\Admin\AppData\Local\Temp\dd135d51b98178b15d4111001131f91a.exe
"C:\Users\Admin\AppData\Local\Temp\dd135d51b98178b15d4111001131f91a.exe"
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 888
2⤵
- Program crash
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4928 -ip 4928
1⤵
PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-133-0x0000000002D20000-0x0000000002D4C000-memory.dmp

Filesize
176KB

Download
memory/4928-135-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/4928-136-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download