modiloader | 0c30ec708892a590444c93edddae43cdb45911940d06bdc65931e75c2583700f

Analysis

max time kernel
131s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 14:48

Target

PO_No_0013011100.exe
Size

1.3MB
MD5

b303f612505ca4e0f716f5c46ea4648d
SHA1

d40300c34cb807ae7f40c9597c0ade63bb9d3921
SHA256

d0cb6fe15a7104c380fdae815eca883d2167bab46d2a243c67f13200ff30ff75
SHA512

0a2044e4dbe58a1378eac7316d521d014574ed570663305a71386e72d4f58878a10ec63006f4dc4db74ac4acf866086122c77179ca47b48318491ac7421677d7
SSDEEP

24576:kH+bZn4eJDePreMta+dBZPGBAvPZsRDl4D0:kH7eJiPrVBZPGBJO

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2840-2-0x0000000003740000-0x0000000004740000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2840	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2912	2840	PO_No_0013011100.exe	28
PID 2840 wrote to memory of 2912	2840	PO_No_0013011100.exe	28
PID 2840 wrote to memory of 2912	2840	PO_No_0013011100.exe	28
PID 2840 wrote to memory of 2912	2840	PO_No_0013011100.exe	28

C:\Users\Admin\AppData\Local\Temp\PO_No_0013011100.exe
"C:\Users\Admin\AppData\Local\Temp\PO_No_0013011100.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 844
  2⤵
  - Program crash
  PID:2912

memory/2840-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2840-1-0x0000000003740000-0x0000000004740000-memory.dmp

Filesize
16.0MB

Download
memory/2840-2-0x0000000003740000-0x0000000004740000-memory.dmp

Filesize
16.0MB

Download
memory/2840-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2840-5-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download