modiloader | 7c3ee63168ad6a482c01546202c85ab10c7b2196672bd42876b760f15ea96e05

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 12:16

Target

Swift Advise Copy.exe
Size

958KB
MD5

9f76e4b699ec8f679b9c4b6b8ecd2934
SHA1

21ddc6631488483d7fa891c02fabdda9accefbae
SHA256

7c3ee63168ad6a482c01546202c85ab10c7b2196672bd42876b760f15ea96e05
SHA512

94a9191217e8b9d38d9e17ec8f987e5fa644211803781b15ad512406b504031a6bbcf3205b67d98ee728cf65a274d2615f984a4f950fcd938519e11521a5884b
SSDEEP

12288:AfSx+FaMjOnJBReneIPcVCXGmBOVVrd4yABuAMQsWIUN2FELSvVeCs9axIeBnhnK:CkPMjOn/ieI37BOXZ5oiG2F02sInBhn

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2220-2-0x00000000031E0000-0x00000000041E0000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	2220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2884	2220	Swift Advise Copy.exe	28
PID 2220 wrote to memory of 2884	2220	Swift Advise Copy.exe	28
PID 2220 wrote to memory of 2884	2220	Swift Advise Copy.exe	28
PID 2220 wrote to memory of 2884	2220	Swift Advise Copy.exe	28

C:\Users\Admin\AppData\Local\Temp\Swift Advise Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Advise Copy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 676
  2⤵
  - Program crash
  PID:2884

memory/2220-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2220-1-0x00000000031E0000-0x00000000041E0000-memory.dmp

Filesize
16.0MB

Download
memory/2220-2-0x00000000031E0000-0x00000000041E0000-memory.dmp

Filesize
16.0MB

Download
memory/2220-4-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download