modiloader | 8a005601e52341e8aff3c95cf30f4ede6b874d2b7e6ffdb9afda9425733fc5d7

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 19:26

Target
29af19382bdeadee6d93b98f354e703d.exe
Size 2.1MB
Sample240418-x5hapscf96
SHA256 8a005601e52341e8aff3c95cf30f4ede6b874d2b7e6ffdb9afda9425733fc5d7
MD5 29af19382bdeadee6d93b98f354e703d
SHA1 3d38885812aa0c910025d86e05287600c745f5c8
SHA512 ac5df65acdb4b3fbe288983eb7498761c64e7e3dd4161d1f74a6b749468c7b5b5209474e91e199625933f439785a730d181c30d2379f791ea5f424fc407649ef
SSDEEP 49152:3ARQYxxZrm0UZu0LCi2wcc/Z9L7KtQDSxxZrmh7:3Uxu0UQ0LCccaZ9LU7xuh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1264-2-0x00000000032E0000-0x00000000042E0000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1396	1264	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1396	1264	29af19382bdeadee6d93b98f354e703d.exe	28
PID 1264 wrote to memory of 1396	1264	29af19382bdeadee6d93b98f354e703d.exe	28
PID 1264 wrote to memory of 1396	1264	29af19382bdeadee6d93b98f354e703d.exe	28
PID 1264 wrote to memory of 1396	1264	29af19382bdeadee6d93b98f354e703d.exe	28

C:\Users\Admin\AppData\Local\Temp\29af19382bdeadee6d93b98f354e703d.exe
"C:\Users\Admin\AppData\Local\Temp\29af19382bdeadee6d93b98f354e703d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 680
  2⤵
  - Program crash
  PID:1396

memory/1264-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Download

memory/1264-1-0x00000000032E0000-0x00000000042E0000-memory.dmp

Download

memory/1264-2-0x00000000032E0000-0x00000000042E0000-memory.dmp

Download

memory/1264-4-0x00000000002A0000-0x00000000002A1000-memory.dmp

Download

memory/1264-5-0x0000000000400000-0x0000000000623000-memory.dmp

Download