modiloader | 1a7f7c0a64376d8a3a50108ba242b2d22a63311aca5f350a0b057428e3c1b30b

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 20:23

Target

02fe22ad34c3e5ff1da4987fbb662e59.exe
Size

685KB
MD5

02fe22ad34c3e5ff1da4987fbb662e59
SHA1

66470a525ff345d460ccc731bfbc3f962181b037
SHA256

1a7f7c0a64376d8a3a50108ba242b2d22a63311aca5f350a0b057428e3c1b30b
SHA512

fa7628d2a7ce06bea0c2d956c4c18102c5bc69cfdee6bb940b8d8154c7d66b2a1c008c7a5d4b675863982893c5394191b2ff86137e07fc8debe37ead0fe656dc
SSDEEP

12288:lJXAGTI10JLFxYQnb75ifKWX0PBSadRqtV7oQZLVT78:3wGc0JLIQxiyBsye1VTw

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2372-1-0x0000000000400000-0x00000000004BBCE4-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process
2408	2372	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2408	2372	02fe22ad34c3e5ff1da4987fbb662e59.exe	14
PID 2372 wrote to memory of 2408	2372	02fe22ad34c3e5ff1da4987fbb662e59.exe	14
PID 2372 wrote to memory of 2408	2372	02fe22ad34c3e5ff1da4987fbb662e59.exe	14
PID 2372 wrote to memory of 2408	2372	02fe22ad34c3e5ff1da4987fbb662e59.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 284
1⤵
- Program crash
PID:2408

C:\Users\Admin\AppData\Local\Temp\02fe22ad34c3e5ff1da4987fbb662e59.exe
"C:\Users\Admin\AppData\Local\Temp\02fe22ad34c3e5ff1da4987fbb662e59.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372

memory/2372-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x0000000000400000-0x00000000004BBCE4-memory.dmp

Filesize
751KB

Download
memory/2372-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download