modiloader | cb77a657a66b25d880617cdfb83d82f5b94bd8272809bb585cbfe1932dc42f98

Analysis

max time kernel
141s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:46

Target

12ee0f9ac85015a66a941a2b094fe707.exe
Size

711KB
MD5

12ee0f9ac85015a66a941a2b094fe707
SHA1

d64b5348bd4d884285c1a7bffa50889f8fa86789
SHA256

cb77a657a66b25d880617cdfb83d82f5b94bd8272809bb585cbfe1932dc42f98
SHA512

4cf0a25bdfd83fcc81e4f57b0e5459bca378cea95cf8dfa0dfda10ee36701969fe32f5fc2d18278c0bccc78cafb54e12a024e4442cfbfe53c5f6108c992cb52c
SSDEEP

12288:RtS5RTQ7aT7YilhjzAF4gv6tLWAfyI0xkaa+5jqJ6ATO:fc22T7BRS46kWAfyWMjq8AT

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2420-1-0x0000000000400000-0x00000000004B8000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	2420	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2124	2420	12ee0f9ac85015a66a941a2b094fe707.exe	28
PID 2420 wrote to memory of 2124	2420	12ee0f9ac85015a66a941a2b094fe707.exe	28
PID 2420 wrote to memory of 2124	2420	12ee0f9ac85015a66a941a2b094fe707.exe	28
PID 2420 wrote to memory of 2124	2420	12ee0f9ac85015a66a941a2b094fe707.exe	28

C:\Users\Admin\AppData\Local\Temp\12ee0f9ac85015a66a941a2b094fe707.exe
"C:\Users\Admin\AppData\Local\Temp\12ee0f9ac85015a66a941a2b094fe707.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 288
  2⤵
  - Program crash
  PID:2124

memory/2420-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2420-1-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2420-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download