modiloader | 44642ad5c2b37a1ebb62e732c4e981e52c7f6a1d11784ba81f18bd5f2791d3fc

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 13:16

Target

44642ad5c2b37a1ebb62e732c4e981e52c7f6a1d11784ba81f18bd5f2791d3fc.exe
Size

399KB
MD5

8e2b1fad31eb2b0cf942fc1d35b848dd
SHA1

2156fcde436f997454cc500b4bdd4e98d52c261d
SHA256

44642ad5c2b37a1ebb62e732c4e981e52c7f6a1d11784ba81f18bd5f2791d3fc
SHA512

0d206f45d2fc5fcb88513016272afabfeed8e24112c6acf69eda8037357f7c508ff876945150019df8f88e540a19539ec55603a027d30962f81699693723f028
SSDEEP

6144:StCt2rjLk8Tcbv8r8HaF6DZn1ULv3nKwnAi8v7peNUM320/rIpwY7MdnKe4j0:NtuLk8TcraFQnWLvXKwnF27p29YNog0

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2492-2-0x0000000000400000-0x000000000051B000-memory.dmp	modiloader_stage1

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2492-0-0x0000000000400000-0x000000000051B000-memory.dmp	upx
behavioral1/memory/2492-2-0x0000000000400000-0x000000000051B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\44642ad5c2b37a1ebb62e732c4e981e52c7f6a1d11784ba81f18bd5f2791d3fc.exe
"C:\Users\Admin\AppData\Local\Temp\44642ad5c2b37a1ebb62e732c4e981e52c7f6a1d11784ba81f18bd5f2791d3fc.exe"
1⤵
PID:2492

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2492-0-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2492-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2492-2-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2492-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download