modiloader | d881f785f2a8d5975a6ce1fc3e8b3491923583a1e7dff8b8ab32c43e7b98796a | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

509aa2a85136bb70638eb537ad467a77.exe
Size

10KB
MD5

509aa2a85136bb70638eb537ad467a77
SHA1

1eb5101aaf4307bd675fd05d7288f1eba4b0b4b8
SHA256

d881f785f2a8d5975a6ce1fc3e8b3491923583a1e7dff8b8ab32c43e7b98796a
SHA512

bad09f449ecb5d9bc3d9580d4aa596dc47b3697f61d38b25d05d66b59c0b94d367cb66d1e8d4d6b8dea42e7739970c0e317bf81b9a867abb1e9b74b54f54da49
SSDEEP

192:n8C2hh0hydS4YddiPnNu6kr7hHQw9hJ1a8IBT:Mh+ydlyiP4brSwXa8U

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3248-0-0x0000000010000000-0x000000001000A000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3744	3248	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\509aa2a85136bb70638eb537ad467a77.exe
"C:\Users\Admin\AppData\Local\Temp\509aa2a85136bb70638eb537ad467a77.exe"
1⤵
PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 276
  2⤵
  - Program crash
  PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3248 -ip 3248
1⤵
PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3248-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download