modiloader | 2477b5a375ad154feb56435202a0861bc1b87f90cba6e025831417cdc174bd74 | Triage

Analysis

max time kernel
109s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2023 13:39

Sharing

Report Analysis Logs

General

Target

PO-278122212.exe
Size

703KB
MD5

d51332436b02a5a9a5ca3e0f3d70eaea
SHA1

87a5561dd0ad2e85f671c7d3961a33c790c9d20d
SHA256

2477b5a375ad154feb56435202a0861bc1b87f90cba6e025831417cdc174bd74
SHA512

b7b51202c4e36051d3fd49cb3f76810826a2f2ecc7e41577e2108cc7395dbffb9da1057afdbd310d781adeb3963a1561f0d1bdafd4d71f55d7cd69d20f75f12f
SSDEEP

12288:gkI303av+MZO0bfKIosoFwewOfyaEzjOol:gkGv+MZOxpFLwOqaEvO

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4180-133-0x00000000027E0000-0x000000000280C000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3708 4180 WerFault.exe PO-278122212.exe

C:\Users\Admin\AppData\Local\Temp\PO-278122212.exe
"C:\Users\Admin\AppData\Local\Temp\PO-278122212.exe"
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 1988
2⤵
- Program crash
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4180 -ip 4180
1⤵
PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4180-133-0x00000000027E0000-0x000000000280C000-memory.dmp

Filesize
176KB

Download
memory/4180-135-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4180-136-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download