modiloader | 2e0b2c69cb0c57a8c2dc9ec44e4ecf2afd19c494980d3b3800c67bf768b38bd5

Analysis

max time kernel
153s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2023 23:59

Target

20230420f8bca5d0de5f50c6abc8ee7274e4507ekovter.exe
Size

384KB
MD5

f8bca5d0de5f50c6abc8ee7274e4507e
SHA1

d753d5382adadf2f5fb7cd8b8d8f97ff1f7f1afe
SHA256

2e0b2c69cb0c57a8c2dc9ec44e4ecf2afd19c494980d3b3800c67bf768b38bd5
SHA512

b2f5d15f7118fc7c20e4006eadcfbb184b5ad97738c0ab273024db460dde3618a2c43c4ff480d8f5cb31be9d79cd3b1e50ec082784c1655779160237067bc899
SSDEEP

6144:u/6XWr0/M0OTrgZEBCjXm2Zpair5vpofIP2NFFL+In:PXWr6MmyBI22Zp11vpo4aj

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1472-133-0x0000000006560000-0x00000000065C4000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3252 1472 WerFault.exe 20230420f8bca5d0de5f50c6abc8ee7274e4507ekovter.exe

pid	pid_target	process	target process
3252	1472	WerFault.exe	20230420f8bca5d0de5f50c6abc8ee7274e4507ekovter.exe

C:\Users\Admin\AppData\Local\Temp\20230420f8bca5d0de5f50c6abc8ee7274e4507ekovter.exe
"C:\Users\Admin\AppData\Local\Temp\20230420f8bca5d0de5f50c6abc8ee7274e4507ekovter.exe"
1⤵
PID:1472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 496
  2⤵
  - Program crash
  PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1472 -ip 1472
1⤵
PID:3096

memory/1472-133-0x0000000006560000-0x00000000065C4000-memory.dmp

Filesize
400KB

Download