modiloader | 21d113293805e7731ad8021ca35aa2e97b28754d93d97ed1b099175c49b1f494 | Triage

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:57

Sharing

Report Analysis Logs

General

Target

5b0590e404bc1bb7d531d2eec243885b.exe
Size

16KB
MD5

5b0590e404bc1bb7d531d2eec243885b
SHA1

7663a42f1f74f11d334759ccb32aab46c45bde71
SHA256

21d113293805e7731ad8021ca35aa2e97b28754d93d97ed1b099175c49b1f494
SHA512

5769b787b3e8cbb9c4fceff8f834379d8dbade2ea91ba048cb71e3f8285c5f23043a650b82ce764f92fd46b065c9d79e22594201d5a8934d0e28ebf306cc8cc0
SSDEEP

384:9kOWerq8wRGtZfsz6pJPbNGYwdyW8m1TU+zSQ5:OOWerqdRQVsz2DcY2vr1ouL

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2108-0-0x0000000010000000-0x000000001000B000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process
2316	2108	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2316	2108	5b0590e404bc1bb7d531d2eec243885b.exe	14
PID 2108 wrote to memory of 2316	2108	5b0590e404bc1bb7d531d2eec243885b.exe	14
PID 2108 wrote to memory of 2316	2108	5b0590e404bc1bb7d531d2eec243885b.exe	14
PID 2108 wrote to memory of 2316	2108	5b0590e404bc1bb7d531d2eec243885b.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 88
1⤵
- Program crash
PID:2316

C:\Users\Admin\AppData\Local\Temp\5b0590e404bc1bb7d531d2eec243885b.exe
"C:\Users\Admin\AppData\Local\Temp\5b0590e404bc1bb7d531d2eec243885b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download