modiloader | f4cd37ddc7e2fd3a0cbb20a080d1aa31a311968585177d5f763ed4eead0b0322

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4cab603af94ed3047e42a284a535d415.exe
Size

579KB
MD5

4cab603af94ed3047e42a284a535d415
SHA1

c15c9e26bf6df69162ca4a664809ef76d0562e37
SHA256

f4cd37ddc7e2fd3a0cbb20a080d1aa31a311968585177d5f763ed4eead0b0322
SHA512

e2386acb702ee73b0ed5d5b48dabf7ad13fd9f781b956b24b733d3656a7a95413ca5f020e73afcabe8694c70f18b71ffb352b878381b305fdf178d3f99cfacaf
SSDEEP

12288:GBNqc2sUQvNi2+m0ilhXWjeZKwF3Z4mxxN4IxSo62jDrkAc:GCLsliHeX6eowQmXNsohkr

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/3136-11-0x0000000003510000-0x00000000035B8000-memory.dmp	modiloader_stage2
behavioral2/memory/3136-50-0x0000000000400000-0x0000000000551000-memory.dmp	modiloader_stage2
behavioral2/memory/3136-51-0x0000000000400000-0x0000000000551000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	4cab603af94ed3047e42a284a535d415.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3124	3136	WerFault.exe	86

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 3908	3136	4cab603af94ed3047e42a284a535d415.exe	88
PID 3136 wrote to memory of 3908	3136	4cab603af94ed3047e42a284a535d415.exe	88

C:\Users\Admin\AppData\Local\Temp\4cab603af94ed3047e42a284a535d415.exe
"C:\Users\Admin\AppData\Local\Temp\4cab603af94ed3047e42a284a535d415.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3136
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:3908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 652
  2⤵
  - Program crash
  PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 3136
1⤵
PID:4388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3136-0-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/3136-1-0x0000000000B50000-0x0000000000BA4000-memory.dmp

Filesize
336KB

Download
memory/3136-3-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/3136-2-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/3136-4-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/3136-5-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3136-6-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/3136-7-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/3136-8-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/3136-9-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3136-10-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3136-11-0x0000000003510000-0x00000000035B8000-memory.dmp

Filesize
672KB

Download
memory/3136-13-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/3136-12-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/3136-14-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/3136-15-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/3136-16-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3136-18-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3136-19-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3136-20-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3136-17-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3136-21-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3136-22-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3136-23-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-24-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-25-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-26-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-27-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-29-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-30-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-31-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-32-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-33-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-34-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-35-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-36-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-37-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-38-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-39-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-40-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-41-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-42-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-43-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-44-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-45-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-46-0x0000000003510000-0x000000000352B000-memory.dmp

Filesize
108KB

Download
memory/3136-47-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3136-48-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/3136-49-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/3136-50-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/3136-51-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/3136-52-0x0000000000B50000-0x0000000000BA4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads