modiloader | 30dd85d625d40167cb0fe5a7935a15a8c167c8bdf8a621690f8c3807db43b781 | Triage

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2023 16:28

Sharing

Report Analysis Logs

General

Target

Deposits.exe
Size

2.3MB
MD5

840c2d19371c8777ad60bd43216850b7
SHA1

f8c1bea9462564236389eaabd21aec2c6f99e86c
SHA256

30dd85d625d40167cb0fe5a7935a15a8c167c8bdf8a621690f8c3807db43b781
SHA512

c1f3e49b071383d0a54a61a72caae5b4c05a23d6426bc83939012f77b848768e13557cab7f48eac7ccc6df26d259b6fb091025c314d407f52387fee4e6e6ef06
SSDEEP

49152:UkQzWGa8pH8yc0/wU2lpe63ZrxKrVEbRIqiPt419Fehg1mQ5C:UNqGa8pcyV/wjpdZrxEVEtI14pqn

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/884-2-0x00000000031E0000-0x00000000041E0000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\Deposits.exe
"C:\Users\Admin\AppData\Local\Temp\Deposits.exe"
1⤵
PID:884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-0-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/884-1-0x00000000031E0000-0x00000000041E0000-memory.dmp

Filesize
16.0MB

Download
memory/884-2-0x00000000031E0000-0x00000000041E0000-memory.dmp

Filesize
16.0MB

Download
memory/884-4-0x0000000000400000-0x0000000000651000-memory.dmp

Filesize
2.3MB

Download