modiloader | 4329c26bb2edcc3b71fc793876133c57a1c0349f5cf8e84e99485c1b7250c5a6

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-12-2023 16:59

Target

Scandoc122slip.exe
Size

1.1MB
MD5

ed9b76655c361e1511430ef66eb080cf
SHA1

92ee7a5de9d63414b0b8bb5df7d6f1d8574f0dfe
SHA256

4329c26bb2edcc3b71fc793876133c57a1c0349f5cf8e84e99485c1b7250c5a6
SHA512

e5c08ede3b9503f73b933e6e17f1fbaaa2fe121f0f05ef5778b8436575112d25a96a4324c8822613d7424992bf4c31fa44b5d27556675c18945f73f832477c29
SSDEEP

12288:RtVsGMuG7PS2wDtCU6NdObmCfRJqKqMQZLGdVNXbUWsK9h9wAPft4:R0hOSNEN5JqKOGvdUWVJt

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2920-2-0x0000000003280000-0x0000000004280000-memory.dmp	modiloader_stage2

C:\Users\Admin\AppData\Local\Temp\Scandoc122slip.exe
"C:\Users\Admin\AppData\Local\Temp\Scandoc122slip.exe"
1⤵
PID:2920

memory/2920-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2920-1-0x0000000003280000-0x0000000004280000-memory.dmp

Filesize
16.0MB

Download
memory/2920-2-0x0000000003280000-0x0000000004280000-memory.dmp

Filesize
16.0MB

Download
memory/2920-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2920-5-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download