modiloader | cf0f3af0d1e5ced3b22df40c9b968f7a94aaf35df83c985487b850a03f06eaac

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2024, 17:09

Target
827db915aa4460557c01aaf3cd9029e5.exe
Size 420KB
Sample240130-vn9brabdar
SHA256 cf0f3af0d1e5ced3b22df40c9b968f7a94aaf35df83c985487b850a03f06eaac
MD5 827db915aa4460557c01aaf3cd9029e5
SHA1 d8427e1479de407198562a8fb5dea5002d42d74b
SHA512 2e799217534782b51663d49d8389afc4b184863a527aa258d2361e8e3c14989de7e68283ba33b5f285553c214cea77b7a496f88067c0bab5a68854d917b7acf8
SSDEEP 6144:Flb339kNBMv7ZdsgQMdyY2PB52O5lYYVekmpDIwjDlDWURdSNmX2DviV1llcBb6V:v9fQHY222EjSwXOBOmS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1720-0-0x0000000000400000-0x000000000046B000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3224	1720	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\827db915aa4460557c01aaf3cd9029e5.exe
"C:\Users\Admin\AppData\Local\Temp\827db915aa4460557c01aaf3cd9029e5.exe"
1⤵
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 536
  2⤵
  - Program crash
  PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1720 -ip 1720
1⤵
PID:3048

memory/1720-0-0x0000000000400000-0x000000000046B000-memory.dmp

Download