modiloader | e2a3862ddaf7065df767a7ee482d99edd0cae1022b0b93d8637e5bf791f0a034

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 14:56

Target

1ec1661361138f6ea1c2897663a78e1e.exe
Size

26KB
MD5

1ec1661361138f6ea1c2897663a78e1e
SHA1

8d314760f586dacfe472e16d2f2d19e617efb71b
SHA256

e2a3862ddaf7065df767a7ee482d99edd0cae1022b0b93d8637e5bf791f0a034
SHA512

aa160413db98779c3d52d92d1482aa37a893efeca5bd172eaf8e011368058b9c6280783aa9dcc5a8d71152c6f1b5bf2e93cc645e231e94745097f23e58566670
SSDEEP

384:QHvQPWzqES+yiVtI89z60Unr6ngQdtbDvd3PkU8diIiz0JmXBaxrP1+CA9:YbDI8NnowdRl/XXzD83T

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2224-0-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2260	2224	1ec1661361138f6ea1c2897663a78e1e.exe	28
PID 2224 wrote to memory of 2260	2224	1ec1661361138f6ea1c2897663a78e1e.exe	28
PID 2224 wrote to memory of 2260	2224	1ec1661361138f6ea1c2897663a78e1e.exe	28
PID 2224 wrote to memory of 2260	2224	1ec1661361138f6ea1c2897663a78e1e.exe	28

C:\Users\Admin\AppData\Local\Temp\1ec1661361138f6ea1c2897663a78e1e.exe
"C:\Users\Admin\AppData\Local\Temp\1ec1661361138f6ea1c2897663a78e1e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 116
  2⤵
  - Program crash
  PID:2260

memory/2224-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download