modiloader | 397eeadf672933f8ac03bc94ab7e0de52a1df33423e1b185d2201b3777b987b3

Analysis

max time kernel
260s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 16:10

Target

Reports_00029.exe
Size

1.3MB
MD5

f7871f5c7d07bdec96e812276f96f98d
SHA1

8ae1174abd768b7ac56952d2779ef4b99afc65f4
SHA256

1fb45a9a06fd027fdd78def47c4e036367b7ab1179a452a378f08b1092fc9fa5
SHA512

df30bdcf53e69ff3a7c3a3bc507ecf3e29259b21a66d12ed176ccb88d3c50b56b87741f5671f7552b8370c0795ed08b8e27f64c1764f144a857efbef745c8bbd
SSDEEP

24576:HGKwPWRuG1o6yf8301SaPY/6y3hBAzqBz8qC:HqWH300jg

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2368-2-0x0000000003150000-0x0000000004150000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2568	2368	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2568	2368	Reports_00029.exe	28
PID 2368 wrote to memory of 2568	2368	Reports_00029.exe	28
PID 2368 wrote to memory of 2568	2368	Reports_00029.exe	28
PID 2368 wrote to memory of 2568	2368	Reports_00029.exe	28

C:\Users\Admin\AppData\Local\Temp\Reports_00029.exe
"C:\Users\Admin\AppData\Local\Temp\Reports_00029.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 704
  2⤵
  - Program crash
  PID:2568

memory/2368-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x0000000003150000-0x0000000004150000-memory.dmp

Filesize
16.0MB

Download
memory/2368-2-0x0000000003150000-0x0000000004150000-memory.dmp

Filesize
16.0MB

Download
memory/2368-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2368-5-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download