modiloader | fa0728a0588e2953db1a123047453f0be27407c6007f3d823c75530de5db0050 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 09:32

Sharing

Report Analysis Logs

General

Target

5895dbd75788824a64bb774d83d62ef0.exe
Size

1.0MB
MD5

5895dbd75788824a64bb774d83d62ef0
SHA1

f5f33ea6afd66b48eedbaa6aa385c0168c69f952
SHA256

fa0728a0588e2953db1a123047453f0be27407c6007f3d823c75530de5db0050
SHA512

30046ae9c9998fef3319fd1dece93b601d39dff19892b47f0049fbea78590855b89a12ab578e5aa0acbf7a1172ae3e60314ed6370165038fbb281e57c1951996
SSDEEP

24576:1El9v/m2iBXLGqWrIe5qOdSiT5exYPDsgtBXXGvdW:1Enhsm/5J7TcxssgPcW

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3976-0-0x0000000000400000-0x0000000000509000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4644	3976	WerFault.exe	15

C:\Users\Admin\AppData\Local\Temp\5895dbd75788824a64bb774d83d62ef0.exe
"C:\Users\Admin\AppData\Local\Temp\5895dbd75788824a64bb774d83d62ef0.exe"
1⤵
PID:3976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 212
  2⤵
  - Program crash
  PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3976 -ip 3976
1⤵
PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3976-0-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download