modiloader | 3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-12-2023 16:42

Target

NEAS.3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670exe.exe
Size

2.8MB
MD5

45434f6f8dad8bcc7b8c9cd663d57d1f
SHA1

caba3f5fcae3fb4738c3d5c91e1e8f05522ec89b
SHA256

3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670
SHA512

8d1f58ba3a8956fe5ccb44c4f8772e1fba16107b7ad6a52b82d8ad4cfef788019dea25ef3ed9d97ec70ddebc4f4d69439381f6e6a8060cb4b15139d1831e134d
SSDEEP

49152:Xm/PpH8yc0/wU2lpe63ZrxKrVEbRIqiPt418Fehg1mQzZ:XOpcyV/wjpdZrxEVEtI14WqnY

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2752-2-0x0000000003550000-0x0000000004550000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\NEAS.3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670exe.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670exe.exe"
1⤵
PID:2752

memory/2752-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2752-1-0x0000000003550000-0x0000000004550000-memory.dmp

Filesize
16.0MB

Download
memory/2752-2-0x0000000003550000-0x0000000004550000-memory.dmp

Filesize
16.0MB

Download
memory/2752-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2752-5-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download