modiloader | fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 15:08

Target

fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe
Size

1.4MB
MD5

af2832545a994fd70976c7ecfc9761d9
SHA1

bc67d8cdd1d2500b485038cc4797c5c4e6ce5da9
SHA256

fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69
SHA512

00bd580ffd06f050bde462282333d72011223aaa6e1c6cd8148041a9f7be9905cf93e855b5f42ebdee7d040669814ea68e8e89e4a50cf836e3a7330b8d03758a
SSDEEP

24576:5E2wBC2CXFIpxe3ODQIcWX7sGYo2NaRJcgLyhFMQnTy/XFOGIvw1k:5EGxfHWLsho2UTIFMQ2/0jo1k

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1940-2-0x00000000030E0000-0x00000000040E0000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3004 1940 WerFault.exe fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe

pid	pid_target	process	target process
3004	1940	WerFault.exe	fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe

description	pid	process	target process
PID 1940 wrote to memory of 3004	1940	fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe	WerFault.exe
PID 1940 wrote to memory of 3004	1940	fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe	WerFault.exe
PID 1940 wrote to memory of 3004	1940	fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe	WerFault.exe
PID 1940 wrote to memory of 3004	1940	fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe
"C:\Users\Admin\AppData\Local\Temp\fcf0d503cefed7e1f1e1c0e699de9d404a247c9792e987adcaaf70763cd08e69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 700
2⤵
- Program crash
PID:3004

memory/1940-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1940-1-0x00000000030E0000-0x00000000040E0000-memory.dmp

Filesize
16.0MB

Download
memory/1940-2-0x00000000030E0000-0x00000000040E0000-memory.dmp

Filesize
16.0MB

Download
memory/1940-4-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download