modiloader | e54d5060f522ac4aae58c95d299bff21e5e6e014c941cd0a9e88485ea29e4ebc

Analysis

max time kernel
131s
max time network
139s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30/05/2023, 00:56

Target
003534262416252.exe
Size 1023KB
Sample230530-back3sec59
SHA256 e54d5060f522ac4aae58c95d299bff21e5e6e014c941cd0a9e88485ea29e4ebc
MD5 7d8ca4eb8f29a87e50322bc202ea2d88
SHA1 f893bd5e1ced9a4b363a315428165dc9f8bb298d
SHA512 ce6285d46bcf0711f5ba89743ff50b608278796ec1a7f8f9c22a96ac82326fad11e0be58ef461a32653af3a11c8b1ccad8159c4c6063925e8d8133649a7a18ac
SSDEEP 12288:jRmIcCn67ZSgSZcKqe5aITzOFjHYsHlTs6EJqdvcFsymAkm4crYF+T:jR8zS0GTzA48InMvamcrYo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/924-54-0x00000000005C0000-0x00000000005F2000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	924	WerFault.exe	27

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1784	924	003534262416252.exe	28
PID 924 wrote to memory of 1784	924	003534262416252.exe	28
PID 924 wrote to memory of 1784	924	003534262416252.exe	28
PID 924 wrote to memory of 1784	924	003534262416252.exe	28

C:\Users\Admin\AppData\Local\Temp\003534262416252.exe
"C:\Users\Admin\AppData\Local\Temp\003534262416252.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 708
  2⤵
  - Program crash
  PID:1784

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 62KB
SHA256 7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1
MD5 b5fcc55cffd66f38d548e8b63206c5e6
SHA1 79db08ababfa33a4f644fa8fe337195b5aba44c7
SHA512 aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/924-54-0x00000000005C0000-0x00000000005F2000-memory.dmp

Download

memory/924-56-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/924-57-0x0000000000400000-0x0000000000508000-memory.dmp

Download