modiloader | 8fc8cf26214f21216acf9a813b5e585ed7e7c23f36d49ab7a65c93f8fffa9510

Analysis

max time kernel
134s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-04-2023 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BOQ_BNBC Contracting L.L.C/BOQ_BNBC Contracting L.L.C..exe
Size

124.0MB
MD5

79ec74ebfb2ee63aaabe7de8393fc6e7
SHA1

e1c18d5d0093b04598c2047aa6cc976cbfa596f4
SHA256

1c9ae205c0b92c0ef2406231c2039746319931ef2345d22645c0bc88d22a3f75
SHA512

b44eed801f4adb9bbbb14bc80ab4cd8cf9fffaa1354b0eba6e959270ee15ed41ced8933db70e8e000114ef3dbb020aeae2c81471bd65a698fa77c9994b8ebeb3
SSDEEP

12288:cjtATpxC7cYFqGwib8yzaeCvFJIqtIz2XxkJ/PufCUWUo2:cjt2pHYkUraDvFTIaBkJ/Pu/ro

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1156-54-0x00000000004D0000-0x00000000004FC000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\BOQ_BNBC Contracting L.L.C\BOQ_BNBC Contracting L.L.C..exe
"C:\Users\Admin\AppData\Local\Temp\BOQ_BNBC Contracting L.L.C\BOQ_BNBC Contracting L.L.C..exe"
1⤵
PID:1156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF33D.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
memory/1156-71-0x0000000003950000-0x000000000398A000-memory.dmp

Filesize
232KB

Download
memory/1156-59-0x0000000002210000-0x0000000002226000-memory.dmp

Filesize
88KB

Download
memory/1156-72-0x0000000003990000-0x00000000039C8000-memory.dmp

Filesize
224KB

Download
memory/1156-60-0x0000000003670000-0x00000000036AB000-memory.dmp

Filesize
236KB

Download
memory/1156-61-0x0000000003610000-0x000000000361E000-memory.dmp

Filesize
56KB

Download
memory/1156-62-0x0000000003BC0000-0x0000000003C1A000-memory.dmp

Filesize
360KB

Download
memory/1156-63-0x0000000003C20000-0x0000000003C30000-memory.dmp

Filesize
64KB

Download
memory/1156-64-0x0000000003D90000-0x0000000003D9D000-memory.dmp

Filesize
52KB

Download
memory/1156-73-0x00000000039D0000-0x00000000039E7000-memory.dmp

Filesize
92KB

Download
memory/1156-66-0x0000000003DE0000-0x0000000003E18000-memory.dmp

Filesize
224KB

Download
memory/1156-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1156-58-0x0000000000570000-0x0000000000587000-memory.dmp

Filesize
92KB

Download
memory/1156-65-0x0000000003DC0000-0x0000000003DD2000-memory.dmp

Filesize
72KB

Download
memory/1156-74-0x00000000039F0000-0x0000000003A2D000-memory.dmp

Filesize
244KB

Download
memory/1156-75-0x0000000003A30000-0x0000000003A46000-memory.dmp

Filesize
88KB

Download
memory/1156-76-0x0000000003A60000-0x0000000003A7C000-memory.dmp

Filesize
112KB

Download
memory/1156-78-0x0000000003FE0000-0x0000000003FF5000-memory.dmp

Filesize
84KB

Download
memory/1156-79-0x0000000004000000-0x000000000400E000-memory.dmp

Filesize
56KB

Download
memory/1156-86-0x0000000004330000-0x0000000004388000-memory.dmp

Filesize
352KB

Download
memory/1156-87-0x0000000004390000-0x00000000043DF000-memory.dmp

Filesize
316KB

Download
memory/1156-57-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1156-54-0x00000000004D0000-0x00000000004FC000-memory.dmp

Filesize
176KB

Download