modiloader | e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb.exe
Size

3.7MB
MD5

e325e33696056f51e536df504637b600
SHA1

28a5a15a5da76f89acf922bb2e450767c36954ab
SHA256

e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb
SHA512

13f9fc204acc3aad9543ae52aec51152a840862ad2fd5521d2630e371106238a0ac1b736b22a8fa7b48602eed6a13f92b0536585b25485a7a5a96c081cf1ec8a
SSDEEP

98304:eBUrWOjePzbQdI5+SZ3OADrYCFP1vSBT:eCrlePz8A++3dYMdSB

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4856-1-0x0000000000400000-0x00000000007C8000-memory.dmp	modiloader_stage1

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

N/A. 1 IoCs

N/A.

dropper

Processes:

resource	yara_rule
behavioral2/memory/4856-1-0x0000000000400000-0x00000000007C8000-memory.dmp	dropper_html

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb.exe

pid	process
4856	e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb.exe
4856	e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb.exe
4856	e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb.exe
4856	e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb.exe
4856	e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb.exe

C:\Users\Admin\AppData\Local\Temp\e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb.exe
"C:\Users\Admin\AppData\Local\Temp\e72d6f43bd66e33552dfb0371435ecb5934151c06391c9891249b4d90e92b9bb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4856-0-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/4856-1-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/4856-3-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download