modiloader | 42ac8e7e9df9877af1382f5626fd74e63210d307f6d577cd5b387ffd0c9520bd

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 11:14

Target

tmp.exe
Size

1.6MB
MD5

2cc30d206669699e58870623365fef82
SHA1

de5e70f094d0b72660aa57b87667edd9d52971fc
SHA256

42ac8e7e9df9877af1382f5626fd74e63210d307f6d577cd5b387ffd0c9520bd
SHA512

2f1f275b9a928844d8f97dc07aa4d0f53da61fd06a507424a873ba128e71d2754e710dbebe1935adc3dada94b42417b1fc30a1915a40b2cffc655c55d7c62005
SSDEEP

24576:7MkT4gLKu9KKozJQd/HJNRO/BhM6wIJp4m+3bu8U2flxAv:QkTpT9K1mzyhM6wW4mEQ2W

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2952-2-0x00000000034A0000-0x00000000044A0000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2152 2952 WerFault.exe tmp.exe

pid	pid_target	process	target process
2152	2952	WerFault.exe	tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 2952 wrote to memory of 2152	2952	tmp.exe	WerFault.exe
PID 2952 wrote to memory of 2152	2952	tmp.exe	WerFault.exe
PID 2952 wrote to memory of 2152	2952	tmp.exe	WerFault.exe
PID 2952 wrote to memory of 2152	2952	tmp.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 788
2⤵
- Program crash
PID:2152

memory/2952-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2952-1-0x00000000034A0000-0x00000000044A0000-memory.dmp

Filesize
16.0MB

Download
memory/2952-2-0x00000000034A0000-0x00000000044A0000-memory.dmp

Filesize
16.0MB

Download
memory/2952-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2952-5-0x0000000000400000-0x0000000000598000-memory.dmp

Filesize
1.6MB

Download