modiloader | 900bac7f4138efd174067bc8738e8357c97e50abe23af40b0d5825db8b55ce29

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2023 17:30

Target

InquiryOrderSpecificationu.exe
Size

1.1MB
MD5

7494bea6a28b3fa0c89467baad979c48
SHA1

71926b5ee16faacc0878b9983362ee3a09902382
SHA256

900bac7f4138efd174067bc8738e8357c97e50abe23af40b0d5825db8b55ce29
SHA512

2a43e7d131d60c0419d92dd3d01c0f0ae3834c0a220da72dcb5d9f0dc28160d26536cdfe3b1b92b2822fc96837ea36c5af277d64e9e6e5810b8e83b889be1a56
SSDEEP

12288:RtVsGMuG7PS2wDtCU6NdObmC/RJqKqMQZLGdVNXbUWsK9h9wAPft4:R0hOSNENZJqKOGvdUWVJt

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1384-2-0x0000000003EE0000-0x0000000004EE0000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\InquiryOrderSpecificationu.exe
"C:\Users\Admin\AppData\Local\Temp\InquiryOrderSpecificationu.exe"
1⤵
PID:1384

memory/1384-0-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/1384-1-0x0000000003EE0000-0x0000000004EE0000-memory.dmp

Filesize
16.0MB

Download
memory/1384-2-0x0000000003EE0000-0x0000000004EE0000-memory.dmp

Filesize
16.0MB

Download
memory/1384-4-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download