modiloader | 0d697faaa434aab1f13b7b2fe781352880ae9ceda6b9430f6af0950f5ca832e3 | Triage

Analysis

max time kernel
131s
max time network
41s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-05-2023 19:13

Sharing

Report Analysis Logs

General

Target

092726376263728.DOC.exe
Size

798KB
MD5

fc317530c3a698867861a965caa34bad
SHA1

2700a38ef604d78793da302664afc7d27bbb0b1c
SHA256

9973a0ac74f8649b431499862359352cc0e8639f4f46ae5ae2371fcdaaf31320
SHA512

f01c04b08d76f7eef6426a129dc39ea1ab60d99c52804b999b4b89c53d6d83f0ad17db311186f899f4924a5bdd38577ef8d803ae909ff700ccb68c66511d3db9
SSDEEP

12288:TNLhcjoS4FC7ITh3IBPmOt50Pbkttml53kbXJ2zlLj0:T9hcsFCMTaFCKIsbZ2h

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1744-54-0x00000000003C0000-0x00000000003F1000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	1744	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 928	1744	092726376263728.DOC.exe	28
PID 1744 wrote to memory of 928	1744	092726376263728.DOC.exe	28
PID 1744 wrote to memory of 928	1744	092726376263728.DOC.exe	28
PID 1744 wrote to memory of 928	1744	092726376263728.DOC.exe	28

C:\Users\Admin\AppData\Local\Temp\092726376263728.DOC.exe
"C:\Users\Admin\AppData\Local\Temp\092726376263728.DOC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 680
  2⤵
  - Program crash
  PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-54-0x00000000003C0000-0x00000000003F1000-memory.dmp

Filesize
196KB

Download
memory/1744-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1744-57-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download