modiloader | 9252eb742965464c01f4a085098e73c06ebbeb3449e8e8afe3f020f4945c0aaf

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 08:40

Target
8be414a7a7ab8feb591815222c862274.exe
Size 16KB
Sample240203-kk2gmafffp
SHA256 9252eb742965464c01f4a085098e73c06ebbeb3449e8e8afe3f020f4945c0aaf
MD5 8be414a7a7ab8feb591815222c862274
SHA1 9bdef0838ed9dc806b16a92ef63a43a0e78db91b
SHA512 a305274a85c36f8c92b52c19c2e6e13b2719fbd59de03b27512df4928717ae37e2bfd79161d10c974a6bf7a6e4a7654ad13cd43cb88844d9e012962334203eca
SSDEEP 384:skOWerq8wvGtZfsz6pJPbNGYQzyW8m1T0+zSQ5:nOWerqdvQVsz2DcYAvr1QuL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2224-0-0x0000000010000000-0x000000001000B000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	2224	WerFault.exe	14

C:\Users\Admin\AppData\Local\Temp\8be414a7a7ab8feb591815222c862274.exe
"C:\Users\Admin\AppData\Local\Temp\8be414a7a7ab8feb591815222c862274.exe"
1⤵
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 284
  2⤵
  - Program crash
  PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2224 -ip 2224
1⤵
PID:4440

memory/2224-0-0x0000000010000000-0x000000001000B000-memory.dmp

Download