modiloader | 62f600400e1d03e8e9abe44fc8fd40100fc9bbd4eeb55ac03de7f6d1ed2d9771

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 21:11

Target

Ref-OTR-02811853280324992230.exe
Size

1.2MB
MD5

42ed296028e6834ed96586dfc820da02
SHA1

1794d672ee43a8180a09c3a0549d770aa2442cf4
SHA256

2a24851c378f0a1a2a2b2c38d47872ce54763c1d692010ad8fad4ad1c5b1a42e
SHA512

ab810148ae2c9710689273c58edcf8bf9b05a530b7441c328a2dc08abc4f403790c5e3b4afc8c0ad963d24ccc9d443fd4485b0dfc7da7da42b28d1ef6f6c5f05
SSDEEP

12288:W2M1Hhkc6bYfsiBq8rI7gti8POOS5a9FWGk4vozUNMHPn0ezCgueiDrqOsykr2Cw:WB16cEiw8k7gtI/pLzhv0DUr2Ch9ztp

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2940-2-0x0000000003300000-0x0000000004300000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2668 2940 WerFault.exe Ref-OTR-02811853280324992230.exe

pid	pid_target	process	target process
2668	2940	WerFault.exe	Ref-OTR-02811853280324992230.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Ref-OTR-02811853280324992230.exe

description	pid	process	target process
PID 2940 wrote to memory of 2668	2940	Ref-OTR-02811853280324992230.exe	WerFault.exe
PID 2940 wrote to memory of 2668	2940	Ref-OTR-02811853280324992230.exe	WerFault.exe
PID 2940 wrote to memory of 2668	2940	Ref-OTR-02811853280324992230.exe	WerFault.exe
PID 2940 wrote to memory of 2668	2940	Ref-OTR-02811853280324992230.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Ref-OTR-02811853280324992230.exe
"C:\Users\Admin\AppData\Local\Temp\Ref-OTR-02811853280324992230.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 712
2⤵
- Program crash
PID:2668

memory/2940-1-0x0000000003300000-0x0000000004300000-memory.dmp

Filesize
16.0MB

Download
memory/2940-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2940-2-0x0000000003300000-0x0000000004300000-memory.dmp

Filesize
16.0MB

Download
memory/2940-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2940-5-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download