modiloader | dc492bb80dd321541b2309765b78bd5e9a0ae7310e4ede6578b6888614b257df | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 17:43

Sharing

Report Analysis Logs

General

Target

c67dbc66a66d26a47c47b3e31ff4097d.exe
Size

132KB
MD5

c67dbc66a66d26a47c47b3e31ff4097d
SHA1

f4906146e1df950e70038de41f169948fec56455
SHA256

dc492bb80dd321541b2309765b78bd5e9a0ae7310e4ede6578b6888614b257df
SHA512

25d3d7e616c6ba18e1ac816e858e33e4f6794bfd3654ba2d3fe2ec828d9028d3192f7ed3d3486bbe02b6fb08112ade29d42adf1df2ef32aebfbf9ba785e59957
SSDEEP

3072:C7mM41OcTR0jLZ6FVienxUzVgTbbKg3Ab9AzFJtTHI:CSlV+901xUmTigQ0a

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1432-0-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\1.MZP	c67dbc66a66d26a47c47b3e31ff4097d.exe
File created	C:\Windows\	c67dbc66a66d26a47c47b3e31ff4097d.exe
File created	C:\Windows\1.MZP	c67dbc66a66d26a47c47b3e31ff4097d.exe

C:\Users\Admin\AppData\Local\Temp\c67dbc66a66d26a47c47b3e31ff4097d.exe
"C:\Users\Admin\AppData\Local\Temp\c67dbc66a66d26a47c47b3e31ff4097d.exe"
1⤵
- Drops file in Windows directory
PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1432-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download