modiloader | ae39d4665f3d31c1fe4f380c446519d4bb25314267c9c2a61605d2313a76d5b7

Analysis

max time kernel
130s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 14:18

Target

FACT09865456000900[1].exe
Size

865KB
MD5

1b10d3892be9b8ec9321453186a37807
SHA1

30ebf57646c9f614e332cc8d91652ad9f6f9cda2
SHA256

ae39d4665f3d31c1fe4f380c446519d4bb25314267c9c2a61605d2313a76d5b7
SHA512

2528b47115e96c434b02e70c5997d86cd7f31e178a0883627caa0577b32961fc4ef1a4ce32f5af6aeda37ea5bcf5e65749d6c0f532955133e1a3bc823093a7c4
SSDEEP

24576:118acXroMvoMpaUkd72Ez0QjZe6y/+0y:1Sx2572Q7jI68

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/340-2-0x0000000002EF0000-0x0000000003EF0000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2644 340 WerFault.exe FACT09865456000900[1].exe

pid	pid_target	process	target process
2644	340	WerFault.exe	FACT09865456000900[1].exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

FACT09865456000900[1].exe

description	pid	process	target process
PID 340 wrote to memory of 2644	340	FACT09865456000900[1].exe	WerFault.exe
PID 340 wrote to memory of 2644	340	FACT09865456000900[1].exe	WerFault.exe
PID 340 wrote to memory of 2644	340	FACT09865456000900[1].exe	WerFault.exe
PID 340 wrote to memory of 2644	340	FACT09865456000900[1].exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\FACT09865456000900[1].exe
"C:\Users\Admin\AppData\Local\Temp\FACT09865456000900[1].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 716
2⤵
- Program crash
PID:2644

memory/340-0-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/340-1-0x0000000002EF0000-0x0000000003EF0000-memory.dmp

Filesize
16.0MB

Download
memory/340-2-0x0000000002EF0000-0x0000000003EF0000-memory.dmp

Filesize
16.0MB

Download
memory/340-4-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/340-5-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download