modiloader | bbe79190e2c5a3f2fe8561e6a1a9833c8f9001a0eec5d3259b8482b03da2603d

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 19:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

381e13ec198bdfa86365170c6f2375a0.exe
Size

585KB
MD5

381e13ec198bdfa86365170c6f2375a0
SHA1

b02ae231e611e46945f2c214954c4cf01aee8049
SHA256

bbe79190e2c5a3f2fe8561e6a1a9833c8f9001a0eec5d3259b8482b03da2603d
SHA512

09ef0e7cd8bcd65340e010cbd4ec63448e9cacd03ea510e852ec4bbd8ec7c2188cf442f7f373c6c456ea6b7c07d6f742fbc4b365f7e2b33023d04e545ed4a036
SSDEEP

12288:Zku7NUOWp8t9ReFXe0oPyc8irVO+buKGOUF3Z4mxxGoEtlK+kt9T2M7:Zb7o0XtfPyuRRuKGpQmXfGO

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/5088-11-0x0000000000400000-0x0000000000551000-memory.dmp	modiloader_stage2
behavioral2/memory/5088-48-0x0000000000400000-0x0000000000551000-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FieleWay.txt	381e13ec198bdfa86365170c6f2375a0.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	5088	WerFault.exe	17

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 2440	5088	381e13ec198bdfa86365170c6f2375a0.exe	23
PID 5088 wrote to memory of 2440	5088	381e13ec198bdfa86365170c6f2375a0.exe	23

C:\Users\Admin\AppData\Local\Temp\381e13ec198bdfa86365170c6f2375a0.exe
"C:\Users\Admin\AppData\Local\Temp\381e13ec198bdfa86365170c6f2375a0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 656
  2⤵
  - Program crash
  PID:2216
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5088-0-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/5088-1-0x0000000002320000-0x0000000002374000-memory.dmp

Filesize
336KB

Download
memory/5088-2-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/5088-4-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/5088-3-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/5088-6-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/5088-7-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/5088-8-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/5088-9-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/5088-45-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/5088-44-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/5088-43-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/5088-42-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/5088-47-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/5088-41-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/5088-40-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/5088-39-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-38-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-37-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-36-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-35-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-34-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-33-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-32-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-31-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-30-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-29-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-28-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-27-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-26-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-25-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-24-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-23-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-22-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-21-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-20-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-19-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-18-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-17-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-16-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-15-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-14-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/5088-13-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/5088-12-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/5088-11-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/5088-10-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/5088-5-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/5088-49-0x0000000002320000-0x0000000002374000-memory.dmp

Filesize
336KB

Download
memory/5088-48-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads