modiloader | 38da49ec5b62279a600944c4a7bc30b7f07f4f0c589e1148801ac5fe3caa3ba2

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 04:07

Target

e0bb0cca4a808cc8973fcd7d33fd8373.exe
Size

190KB
MD5

e0bb0cca4a808cc8973fcd7d33fd8373
SHA1

3e22ebc320ab09a636aa93f65e00cb6d0f80df72
SHA256

38da49ec5b62279a600944c4a7bc30b7f07f4f0c589e1148801ac5fe3caa3ba2
SHA512

eee1fa4404af6ffcb7b087544f4663eb1db139c680ca5ca983b816d1f55dcf7a8db04c2861c5d52569bc45aebeb4f05e4ea51c9932076910b6de7b902340e4b3
SSDEEP

3072:7OYzDhHEU9URdohnyvkSDmNrvRUyWmt5oFgEb0nN7O9i491Lw5kh3uXsZ61jjgl/:7OYzDhHE8CWhnDbJ5qgH+hHZ61jc5v

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2164-0-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	2164	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1928	2164	e0bb0cca4a808cc8973fcd7d33fd8373.exe	28
PID 2164 wrote to memory of 1928	2164	e0bb0cca4a808cc8973fcd7d33fd8373.exe	28
PID 2164 wrote to memory of 1928	2164	e0bb0cca4a808cc8973fcd7d33fd8373.exe	28
PID 2164 wrote to memory of 1928	2164	e0bb0cca4a808cc8973fcd7d33fd8373.exe	28
PID 2164 wrote to memory of 1916	2164	e0bb0cca4a808cc8973fcd7d33fd8373.exe	29
PID 2164 wrote to memory of 1916	2164	e0bb0cca4a808cc8973fcd7d33fd8373.exe	29
PID 2164 wrote to memory of 1916	2164	e0bb0cca4a808cc8973fcd7d33fd8373.exe	29
PID 2164 wrote to memory of 1916	2164	e0bb0cca4a808cc8973fcd7d33fd8373.exe	29

C:\Users\Admin\AppData\Local\Temp\e0bb0cca4a808cc8973fcd7d33fd8373.exe
"C:\Users\Admin\AppData\Local\Temp\e0bb0cca4a808cc8973fcd7d33fd8373.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\e0bb0cca4a808cc8973fcd7d33fd8373.exe
  e0bb0cca4a808cc8973fcd7d33fd8373.exe
  2⤵
  PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 140
  2⤵
  - Program crash
  PID:1916

memory/2164-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download