modiloader | e1cecfcc4eed2f4b74af7d971dcf24555534db164ddb0b7cd1e821b2f0402703

Analysis

max time kernel
130s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 04:58

Target

da7c2473b5c455f25f420827af596286.exe
Size

1.6MB
MD5

da7c2473b5c455f25f420827af596286
SHA1

101b5f991a26fc9213c4445bd9bfdb87a6a6c5cb
SHA256

e1cecfcc4eed2f4b74af7d971dcf24555534db164ddb0b7cd1e821b2f0402703
SHA512

cd6b9cd996c3bca3aa0be5d0cebebb7db1701878d5c62354d6df4c880d4af8007c95baf7f0ac9e75b099c7b3573dc23afa3a872213a9963b84c86028e6969959
SSDEEP

24576:7MkT4gLKu9KKozJQd/HJNRO/B8M6wIJp4m+3bu8U2flxAv:QkTpT9K1mzy8M6wW4mEQ2W

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2684-2-0x0000000003220000-0x0000000004220000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2944 2684 WerFault.exe da7c2473b5c455f25f420827af596286.exe

pid	pid_target	process	target process
2944	2684	WerFault.exe	da7c2473b5c455f25f420827af596286.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

da7c2473b5c455f25f420827af596286.exe

description	pid	process	target process
PID 2684 wrote to memory of 2944	2684	da7c2473b5c455f25f420827af596286.exe	WerFault.exe
PID 2684 wrote to memory of 2944	2684	da7c2473b5c455f25f420827af596286.exe	WerFault.exe
PID 2684 wrote to memory of 2944	2684	da7c2473b5c455f25f420827af596286.exe	WerFault.exe
PID 2684 wrote to memory of 2944	2684	da7c2473b5c455f25f420827af596286.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\da7c2473b5c455f25f420827af596286.exe
"C:\Users\Admin\AppData\Local\Temp\da7c2473b5c455f25f420827af596286.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 716
2⤵
- Program crash
PID:2944

memory/2684-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2684-1-0x0000000003220000-0x0000000004220000-memory.dmp

Filesize
16.0MB

Download
memory/2684-2-0x0000000003220000-0x0000000004220000-memory.dmp

Filesize
16.0MB

Download
memory/2684-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2684-5-0x0000000000400000-0x0000000000598000-memory.dmp

Filesize
1.6MB

Download