modiloader | 38da49ec5b62279a600944c4a7bc30b7f07f4f0c589e1148801ac5fe3caa3ba2

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 04:07

Target

e0bb0cca4a808cc8973fcd7d33fd8373.exe
Size

190KB
MD5

e0bb0cca4a808cc8973fcd7d33fd8373
SHA1

3e22ebc320ab09a636aa93f65e00cb6d0f80df72
SHA256

38da49ec5b62279a600944c4a7bc30b7f07f4f0c589e1148801ac5fe3caa3ba2
SHA512

eee1fa4404af6ffcb7b087544f4663eb1db139c680ca5ca983b816d1f55dcf7a8db04c2861c5d52569bc45aebeb4f05e4ea51c9932076910b6de7b902340e4b3
SSDEEP

3072:7OYzDhHEU9URdohnyvkSDmNrvRUyWmt5oFgEb0nN7O9i491Lw5kh3uXsZ61jjgl/:7OYzDhHE8CWhnDbJ5qgH+hHZ61jc5v

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/2704-0-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral2/memory/2704-1-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3744	2704	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 3212	2704	e0bb0cca4a808cc8973fcd7d33fd8373.exe	97
PID 2704 wrote to memory of 3212	2704	e0bb0cca4a808cc8973fcd7d33fd8373.exe	97
PID 2704 wrote to memory of 3212	2704	e0bb0cca4a808cc8973fcd7d33fd8373.exe	97

C:\Users\Admin\AppData\Local\Temp\e0bb0cca4a808cc8973fcd7d33fd8373.exe
"C:\Users\Admin\AppData\Local\Temp\e0bb0cca4a808cc8973fcd7d33fd8373.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\e0bb0cca4a808cc8973fcd7d33fd8373.exe
  e0bb0cca4a808cc8973fcd7d33fd8373.exe
  2⤵
  PID:3212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 428
  2⤵
  - Program crash
  PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2704 -ip 2704
1⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:1692

memory/2704-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2704-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download