modiloader | c63dfe6a12bc4bb120241b50c23dc0f247032023e0fa026efdf9a3aead005baf

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 03:15

Target

792275c59580d6ae75bd83a41e89f9c2.exe
Size

691KB
MD5

792275c59580d6ae75bd83a41e89f9c2
SHA1

acc9e95ab1cc324d041b92dafaec686eddba7184
SHA256

c63dfe6a12bc4bb120241b50c23dc0f247032023e0fa026efdf9a3aead005baf
SHA512

1041a6e9fbc0a4a544443709852b13cacf05bebd87979acce371e4fca535824e784f9b4414c54794b885cb85adf7f58bb11cba7acbdbacf779a279f55ac20751
SSDEEP

12288:YCTAYwDNihzKWxnPgSWt0lTXE0B43v++Jw4O87JCoc3KGufVBHB4u/I59vWqp9jU:KYwSKsnPgZEGXa4sKyWqpL3CiNTW

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2092-0-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/2092-2-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	2092	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1916	2092	792275c59580d6ae75bd83a41e89f9c2.exe	15
PID 2092 wrote to memory of 1916	2092	792275c59580d6ae75bd83a41e89f9c2.exe	15
PID 2092 wrote to memory of 1916	2092	792275c59580d6ae75bd83a41e89f9c2.exe	15
PID 2092 wrote to memory of 1916	2092	792275c59580d6ae75bd83a41e89f9c2.exe	15

C:\Users\Admin\AppData\Local\Temp\792275c59580d6ae75bd83a41e89f9c2.exe
"C:\Users\Admin\AppData\Local\Temp\792275c59580d6ae75bd83a41e89f9c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 224
  2⤵
  - Program crash
  PID:1916

memory/2092-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2092-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2092-2-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2092-4-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download