modiloader | 1f3550afc182c66a51c5d40bcafd4713f9b8552afbb52347185d98418d8c1549

Analysis

max time kernel
131s
max time network
33s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 07:11

Target

f6d022437e3ebab46604ace297d22ef6.exe
Size

816KB
MD5

f6d022437e3ebab46604ace297d22ef6
SHA1

e768334e9e09c862f690d97a312e284e0de03cb1
SHA256

1f3550afc182c66a51c5d40bcafd4713f9b8552afbb52347185d98418d8c1549
SHA512

88b2ba4d5795270e2a964a06e0513bdd7b4739475de7c4259ac4a1b781d28754f03454d835a4523b9d41940ad7afbaebc803063887ed69fea450a1340202c15d
SSDEEP

12288:300zh1YnARzVrGgJoowTfehf/lHG6LbO35QPIwuYmmJ/9zaxmx86:39YARzVpWW7hPfbzaxmx8

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2308-55-0x0000000000310000-0x0000000000344000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	2308	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1380	2308	f6d022437e3ebab46604ace297d22ef6.exe	29
PID 2308 wrote to memory of 1380	2308	f6d022437e3ebab46604ace297d22ef6.exe	29
PID 2308 wrote to memory of 1380	2308	f6d022437e3ebab46604ace297d22ef6.exe	29
PID 2308 wrote to memory of 1380	2308	f6d022437e3ebab46604ace297d22ef6.exe	29

C:\Users\Admin\AppData\Local\Temp\f6d022437e3ebab46604ace297d22ef6.exe
"C:\Users\Admin\AppData\Local\Temp\f6d022437e3ebab46604ace297d22ef6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 688
  2⤵
  - Program crash
  PID:1380

memory/2308-55-0x0000000000310000-0x0000000000344000-memory.dmp

Filesize
208KB

Download
memory/2308-57-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2308-58-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download