modiloader | c122084a42b99f006a27e9c48d7098e192704183d3a5dfd57f924c03ae506552

Analysis

max time kernel
140s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 17:38

Target

file.exe
Size

1.5MB
MD5

0c52d0355c15ed92930c645c340a1edb
SHA1

8bfdafa0aa3403c52bf115667833734c4c409581
SHA256

c122084a42b99f006a27e9c48d7098e192704183d3a5dfd57f924c03ae506552
SHA512

7889df8248c8b003b1d9d900bd15b5b215a3fca1f2d783c7f4ffedd6c09143970b7ab217dc3080de6b66c463331776283fc0c3711974eef77e02fea82aafe862
SSDEEP

24576:W4+ufew4vRRm5JjP++3jDSpLHnT3s++Gg0w38LzAqSSiKLWWW9GCdh:W46wV6pLnE3+8Giy5Wt3

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2156-2-0x0000000003210000-0x0000000004210000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2156	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2996	2156	file.exe	28
PID 2156 wrote to memory of 2996	2156	file.exe	28
PID 2156 wrote to memory of 2996	2156	file.exe	28
PID 2156 wrote to memory of 2996	2156	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 700
  2⤵
  - Program crash
  PID:2996

memory/2156-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2156-1-0x0000000003210000-0x0000000004210000-memory.dmp

Filesize
16.0MB

Download
memory/2156-2-0x0000000003210000-0x0000000004210000-memory.dmp

Filesize
16.0MB

Download
memory/2156-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2156-5-0x0000000000400000-0x0000000000583000-memory.dmp

Filesize
1.5MB

Download