modiloader | 14115a4b25f3d0f88969639d30b2ce26ea61409028e441b5dac10c8d4b3a3919

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

192.168.0.201_ClientSetup.exe
Size

4.9MB
MD5

b1d5c9b7445e0472fdaf6be845045ec3
SHA1

0448450f63a21f3c96c50ea6c9b63d1f7870a3c8
SHA256

e8b66676518ff84b417a25942ce398003177f6863440f990c2f98be179dc08df
SHA512

9e5c59e4cd440b68f2c258cac947aa0c968aa088246d8bae0b699a4fe60e500eb10bfabb0d943b536205acb46d592484223bbc92fd24222a9701ca8be129c35c
SSDEEP

98304:LJEkkuDuQ2VHSu28JwhD+Y//hqA3YJc1qjOF5pI/O3wmB3w:LJE9zVHSAAD+Y/PI61qjdkhw

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2144-3-0x0000000000400000-0x0000000000F47000-memory.dmp	modiloader_stage1
behavioral1/memory/2144-7-0x0000000000400000-0x0000000000F47000-memory.dmp	modiloader_stage1

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\192.168.0.201_ClientSetup.exe
"C:\Users\Admin\AppData\Local\Temp\192.168.0.201_ClientSetup.exe"
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-0-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2144-1-0x0000000001600000-0x0000000002147000-memory.dmp

Filesize
11.3MB

Download
memory/2144-2-0x0000000001600000-0x0000000002147000-memory.dmp

Filesize
11.3MB

Download
memory/2144-3-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2144-4-0x00000000002B0000-0x0000000000304000-memory.dmp

Filesize
336KB

Download
memory/2144-5-0x0000000001600000-0x0000000002147000-memory.dmp

Filesize
11.3MB

Download
memory/2144-6-0x0000000003D90000-0x0000000003D92000-memory.dmp

Filesize
8KB

Download
memory/2144-7-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2144-9-0x0000000001600000-0x0000000002147000-memory.dmp

Filesize
11.3MB

Download