modiloader | 6795da1f874c3ebe8bc7b8f40fdfae84de07d8b838da4064deca2c445033f1b2

Analysis

max time kernel
130s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 15:30

Target

Elenco nuovi ordini.exe
Size

1.3MB
MD5

d7a658ea3225d4055113631cd346efcc
SHA1

203844d526b6d38f95f003500602e8aa7eb0e197
SHA256

6795da1f874c3ebe8bc7b8f40fdfae84de07d8b838da4064deca2c445033f1b2
SHA512

7d92de126e206d94832bff18889e412b37e9714d1089d4155e02a14b82b643cca99713a95e0bf6aa6a4424835d192c2f09fa3a26a6ad5e20eb3708d3ccfaafdc
SSDEEP

24576:kH+bZn4eJDePreMta+dBZPGBAvPZsRDl4D0:kH7eJiPrVBZPGBJO

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2476-2-0x0000000003790000-0x0000000004790000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2476	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2660	2476	Elenco nuovi ordini.exe	28
PID 2476 wrote to memory of 2660	2476	Elenco nuovi ordini.exe	28
PID 2476 wrote to memory of 2660	2476	Elenco nuovi ordini.exe	28
PID 2476 wrote to memory of 2660	2476	Elenco nuovi ordini.exe	28

C:\Users\Admin\AppData\Local\Temp\Elenco nuovi ordini.exe
"C:\Users\Admin\AppData\Local\Temp\Elenco nuovi ordini.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 848
  2⤵
  - Program crash
  PID:2660

memory/2476-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2476-1-0x0000000003790000-0x0000000004790000-memory.dmp

Filesize
16.0MB

Download
memory/2476-2-0x0000000003790000-0x0000000004790000-memory.dmp

Filesize
16.0MB

Download
memory/2476-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2476-5-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download