modiloader | e1471b0576c26d33b4fda732a7e0aba43193849ef1de6bbcdd42e8724354dd00

Analysis

max time kernel
131s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 20:31

Target

SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe
Size

1.6MB
MD5

39ad433c9ba920e7fd0961c66ac7079e
SHA1

8a54961347eab2253e2004e33f399c4cd07c8577
SHA256

e1471b0576c26d33b4fda732a7e0aba43193849ef1de6bbcdd42e8724354dd00
SHA512

676da03f46446ad3a6e83e7b0d6648e6c82e25d0866fbe13f85ea0a3ec6ffb9fb507b28ae69638a4cf62d51b0aefb934bd20d77605a78d1f8652ef2fd5d38b71
SSDEEP

24576:iyB7eQVOovzwkKEFL3WlrpY7Gv1eeajEja3KgffHCx2GwV/6ltVIaH3:D9VmuL3WZ7vcVjEvGHaKViFJ3

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1944-2-0x0000000002C90000-0x0000000003C90000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	1944	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2712	1944	SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe	28
PID 1944 wrote to memory of 2712	1944	SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe	28
PID 1944 wrote to memory of 2712	1944	SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe	28
PID 1944 wrote to memory of 2712	1944	SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 716
  2⤵
  - Program crash
  PID:2712

memory/1944-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1944-1-0x0000000002C90000-0x0000000003C90000-memory.dmp

Filesize
16.0MB

Download
memory/1944-2-0x0000000002C90000-0x0000000003C90000-memory.dmp

Filesize
16.0MB

Download
memory/1944-4-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download