modiloader | 6795da1f874c3ebe8bc7b8f40fdfae84de07d8b838da4064deca2c445033f1b2

Analysis

max time kernel
130s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 15:31

Target
Elenco nuovi ordini.exe
Size 1.3MB
Sample240220-sx2bdsbc34
SHA256 6795da1f874c3ebe8bc7b8f40fdfae84de07d8b838da4064deca2c445033f1b2
MD5 d7a658ea3225d4055113631cd346efcc
SHA1 203844d526b6d38f95f003500602e8aa7eb0e197
SHA512 7d92de126e206d94832bff18889e412b37e9714d1089d4155e02a14b82b643cca99713a95e0bf6aa6a4424835d192c2f09fa3a26a6ad5e20eb3708d3ccfaafdc
SSDEEP 24576:kH+bZn4eJDePreMta+dBZPGBAvPZsRDl4D0:kH7eJiPrVBZPGBJO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2640-2-0x0000000003850000-0x0000000004850000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
612	2640	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 612	2640	Elenco nuovi ordini.exe	28
PID 2640 wrote to memory of 612	2640	Elenco nuovi ordini.exe	28
PID 2640 wrote to memory of 612	2640	Elenco nuovi ordini.exe	28
PID 2640 wrote to memory of 612	2640	Elenco nuovi ordini.exe	28

C:\Users\Admin\AppData\Local\Temp\Elenco nuovi ordini.exe
"C:\Users\Admin\AppData\Local\Temp\Elenco nuovi ordini.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 752
  2⤵
  - Program crash
  PID:612

memory/2640-0-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2640-1-0x0000000003850000-0x0000000004850000-memory.dmp

Download

memory/2640-2-0x0000000003850000-0x0000000004850000-memory.dmp

Download

memory/2640-4-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2640-5-0x0000000000400000-0x0000000000558000-memory.dmp

Download