modiloader | 947365df7a1ad94cfa2029db2c88985f3d34df5b9076e5392eeda08c6f7ba673

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2023 07:34

Target

947365df7a1ad94cfa2029db2c88985f3d34df5b9076e5392eeda08c6f7ba673.exe
Size

1.9MB
MD5

6109410cc52c8810d9c1175f54a058e4
SHA1

c4ac41c6b88baee959e9a8752679a426b8dfa547
SHA256

947365df7a1ad94cfa2029db2c88985f3d34df5b9076e5392eeda08c6f7ba673
SHA512

7a8d49155f42e8b8b78d48ac31fae1e42b1fe31609074b316c96539ea820d5bced611e3f7f314c115242abfd70cdad61d2ad73a568e3b7d2cf1e1cec91621f8d
SSDEEP

49152:Ad8fIwCjykkGo5ITnLK+Ey9S1qXtfRGHKpk3H8eiTwHFimH9jIrMKSIa+GGXHIf+:AdoIwkkrITnG69S1qXtfRGHKpk3H8eiD

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1568-2-0x0000000004050000-0x0000000005050000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\947365df7a1ad94cfa2029db2c88985f3d34df5b9076e5392eeda08c6f7ba673.exe
"C:\Users\Admin\AppData\Local\Temp\947365df7a1ad94cfa2029db2c88985f3d34df5b9076e5392eeda08c6f7ba673.exe"
1⤵
PID:1568

memory/1568-0-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/1568-1-0x0000000004050000-0x0000000005050000-memory.dmp

Filesize
16.0MB

Download
memory/1568-2-0x0000000004050000-0x0000000005050000-memory.dmp

Filesize
16.0MB

Download
memory/1568-4-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download
memory/1568-6-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download