modiloader | 3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2023 16:42

Target

NEAS.3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670exe.exe
Size

2.8MB
MD5

45434f6f8dad8bcc7b8c9cd663d57d1f
SHA1

caba3f5fcae3fb4738c3d5c91e1e8f05522ec89b
SHA256

3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670
SHA512

8d1f58ba3a8956fe5ccb44c4f8772e1fba16107b7ad6a52b82d8ad4cfef788019dea25ef3ed9d97ec70ddebc4f4d69439381f6e6a8060cb4b15139d1831e134d
SSDEEP

49152:Xm/PpH8yc0/wU2lpe63ZrxKrVEbRIqiPt418Fehg1mQzZ:XOpcyV/wjpdZrxEVEtI14WqnY

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4852-2-0x00000000041A0000-0x00000000051A0000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\NEAS.3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670exe.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3e79d6c84d60f1c6b371cc8f98312a28da7698e4ab225848268356d86c733670exe.exe"
1⤵
PID:4852

memory/4852-0-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4852-1-0x00000000041A0000-0x00000000051A0000-memory.dmp

Filesize
16.0MB

Download
memory/4852-2-0x00000000041A0000-0x00000000051A0000-memory.dmp

Filesize
16.0MB

Download
memory/4852-4-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download
memory/4852-6-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download