modiloader | 5a03f336442ebb042d239bbebbe1871b9d42848383d1ca88c342b453a24d80a0

Analysis

max time kernel
163s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2023 07:15

Target

2477b5a375ad154feb56435202a0861bc1b87f90cba6e025831417cdc174bd74.exe
Size

703KB
MD5

d51332436b02a5a9a5ca3e0f3d70eaea
SHA1

87a5561dd0ad2e85f671c7d3961a33c790c9d20d
SHA256

2477b5a375ad154feb56435202a0861bc1b87f90cba6e025831417cdc174bd74
SHA512

b7b51202c4e36051d3fd49cb3f76810826a2f2ecc7e41577e2108cc7395dbffb9da1057afdbd310d781adeb3963a1561f0d1bdafd4d71f55d7cd69d20f75f12f
SSDEEP

12288:gkI303av+MZO0bfKIosoFwewOfyaEzjOol:gkGv+MZOxpFLwOqaEvO

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4016-134-0x00000000027E0000-0x000000000280C000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5068 4016 WerFault.exe 2477b5a375ad154feb56435202a0861bc1b87f90cba6e025831417cdc174bd74.exe

pid	pid_target	process	target process
5068	4016	WerFault.exe	2477b5a375ad154feb56435202a0861bc1b87f90cba6e025831417cdc174bd74.exe

C:\Users\Admin\AppData\Local\Temp\2477b5a375ad154feb56435202a0861bc1b87f90cba6e025831417cdc174bd74.exe
"C:\Users\Admin\AppData\Local\Temp\2477b5a375ad154feb56435202a0861bc1b87f90cba6e025831417cdc174bd74.exe"
1⤵
PID:4016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1892
  2⤵
  - Program crash
  PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4016 -ip 4016
1⤵
PID:4048

memory/4016-133-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4016-134-0x00000000027E0000-0x000000000280C000-memory.dmp

Filesize
176KB

Download
memory/4016-136-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download