modiloader | b25eec1ba4f98d59e8fbb6d5ee791f86ad2ec3882f49a9df12794d1b519fdc14

General

Target

00987764545456467.exe
Size

790KB
MD5

49985cf212ea355f93e38481c8376734
SHA1

9f1e5fe65d87e70f1a2f46928728f097e15f7517
SHA256

b25eec1ba4f98d59e8fbb6d5ee791f86ad2ec3882f49a9df12794d1b519fdc14
SHA512

67d5d117834d0d611b8c574aecc972cdb8fc99d43a3926947320a56181bf0c1943057a8068d9aa2bc5050d808f67fb49c06b5e1bb25c65696662ef0a701405a6
SSDEEP

24576:rk/A25GoqxIJs7ks3XJrPz6cDCnvM3qv9:rKAKGj7ks35rPmaCnvM6v9

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 43 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3024-59-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-108-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-107-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-106-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-105-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-104-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-103-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-102-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-101-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-100-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-109-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-110-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-99-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-98-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-97-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-96-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-95-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-94-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-93-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-92-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-91-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-90-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-89-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-88-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-87-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-86-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-85-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-84-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-83-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-82-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-81-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-80-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-79-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-78-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-77-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-76-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-75-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-74-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-73-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-72-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-71-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-111-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2
behavioral1/memory/3024-112-0x00000000003C0000-0x00000000003F0000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

560 3024 WerFault.exe 00987764545456467.exe

pid	pid_target	process	target process
560	3024	WerFault.exe	00987764545456467.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

00987764545456467.exe

description	pid	process	target process
PID 3024 wrote to memory of 560	3024	00987764545456467.exe	WerFault.exe
PID 3024 wrote to memory of 560	3024	00987764545456467.exe	WerFault.exe
PID 3024 wrote to memory of 560	3024	00987764545456467.exe	WerFault.exe
PID 3024 wrote to memory of 560	3024	00987764545456467.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\00987764545456467.exe
"C:\Users\Admin\AppData\Local\Temp\00987764545456467.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 688
2⤵
- Program crash
PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab9916.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9958.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/3024-90-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-69-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/3024-108-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-107-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-106-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-105-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-104-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-103-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-102-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-101-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-100-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-109-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-110-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-99-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-98-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-97-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3024-95-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-94-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-93-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-92-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-91-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-88-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-70-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3024-96-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-87-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-86-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-85-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-84-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-83-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-82-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-81-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-80-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-79-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-78-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-77-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-76-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-75-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-74-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-73-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-72-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-71-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-111-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-112-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-89-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/3024-59-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads