modiloader | b8ce7b8f60bb42477ea6bba328bfd310cfec0c1ebbc1f60ce4b2571e240d9d57

General

Target

nfattura scaduta Pdf.exe
Size

1.5MB
MD5

0d4b25a33c69e4443f28a43ae3b015c9
SHA1

92267c25dc62805bdfff9497174bf91feec90f2c
SHA256

869eb1b44b9d5e0ee5b99b1189edd21d706c58094387ba32ebf2aa45703a9c9b
SHA512

f628aaa5e739534b6e7833f44ca96e3a83dc83aac026b0f75c3919e937ed468d18764f1b2347995822e98d3eb6c6797524c0c28d4c6371f3a9c57dab0eac9e1f
SSDEEP

24576:rbGHGrOrQ9gnMC6LO3cQoikKgti8PM2MCUrTDLwVIf2IOXkDtZ3NptsNbJZ:rbGWAJeDingti8P+TwSNO0n9vwbJZ

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 43 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2472-59-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-71-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-73-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-72-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-78-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-77-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-76-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-75-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-74-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-80-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-79-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-83-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-84-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-82-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-81-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-85-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-86-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-87-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-89-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-88-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-90-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-91-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-92-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-93-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-94-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-95-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-96-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-97-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-98-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-99-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-100-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-102-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-101-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-103-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-104-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-105-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-106-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-107-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-108-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-109-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-110-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-111-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2
behavioral1/memory/2472-112-0x0000000000270000-0x00000000002A1000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1284 2472 WerFault.exe nfattura scaduta Pdf.exe

pid	pid_target	process	target process
1284	2472	WerFault.exe	nfattura scaduta Pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

nfattura scaduta Pdf.exe

description	pid	process	target process
PID 2472 wrote to memory of 1284	2472	nfattura scaduta Pdf.exe	WerFault.exe
PID 2472 wrote to memory of 1284	2472	nfattura scaduta Pdf.exe	WerFault.exe
PID 2472 wrote to memory of 1284	2472	nfattura scaduta Pdf.exe	WerFault.exe
PID 2472 wrote to memory of 1284	2472	nfattura scaduta Pdf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\nfattura scaduta Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\nfattura scaduta Pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 692
2⤵
- Program crash
PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabAE6A.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE8C.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/2472-91-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-69-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/2472-71-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-73-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-72-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-78-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-77-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-76-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-75-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-74-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-80-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-79-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-83-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-84-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-82-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-81-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-54-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2472-86-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-87-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-89-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-88-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-90-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-93-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-70-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2472-85-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-94-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-95-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-96-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-97-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-98-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-99-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-100-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-102-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-101-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-103-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-104-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-105-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-106-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-107-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-108-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-109-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-110-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-111-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-112-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-92-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2472-59-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads