modiloader | 119bb4f428f6056330cf8a0087b1a52277dbceca3cd81f1d5934c4f4a398c664

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

119bb4f428f6056330cf8a0087b1a52277dbceca3cd81f1d5934c4f4a398c664.exe
Size

1.2MB
MD5

c57b287858b87f3528e1366bcb4359e8
SHA1

2629391b45ae9cb08c5df8dd53bdc7c7f222c171
SHA256

119bb4f428f6056330cf8a0087b1a52277dbceca3cd81f1d5934c4f4a398c664
SHA512

0100caab7532f3adeb4f6302c76dd44e2ab5ebca9dde4e39d73895d4ecda7341e825b73aa4ebeac16873be79c0352c60baec5c59508429043c9515c777202476
SSDEEP

24576:erGbRrkUYzzxxNv4zomYUm2MA5H8g24ZrH:eKKwomY2MA9m2H

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 63 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2964-2-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-4-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-5-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-3-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-6-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-9-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-12-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-48-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-49-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-64-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-63-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-62-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-58-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-56-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-54-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-53-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-51-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-47-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-45-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-46-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-44-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-42-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-41-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-40-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-38-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-37-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-36-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-35-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-33-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-32-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-31-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-29-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-27-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-28-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-25-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-66-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-23-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-65-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-24-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-60-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-57-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-55-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-22-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-52-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-50-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-20-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-19-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-43-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-17-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-39-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-16-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-34-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-30-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-26-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-13-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-21-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-18-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-15-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-14-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-11-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-10-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-8-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2
behavioral2/memory/2964-7-0x0000000002D40000-0x0000000003D40000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3856 2964 WerFault.exe 119bb4f428f6056330cf8a0087b1a52277dbceca3cd81f1d5934c4f4a398c664.exe

pid	pid_target	process	target process
3856	2964	WerFault.exe	119bb4f428f6056330cf8a0087b1a52277dbceca3cd81f1d5934c4f4a398c664.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Users\Admin\AppData\Local\Temp\119bb4f428f6056330cf8a0087b1a52277dbceca3cd81f1d5934c4f4a398c664.exe
"C:\Users\Admin\AppData\Local\Temp\119bb4f428f6056330cf8a0087b1a52277dbceca3cd81f1d5934c4f4a398c664.exe"
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1788
2⤵
- Program crash
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2964 -ip 2964
1⤵
PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/2964-1-0x0000000000400000-0x0000000000948000-memory.dmp

Filesize
5.3MB

Download
memory/2964-2-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-4-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-5-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-3-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-6-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-9-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-12-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-48-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-49-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-64-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-63-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-62-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-58-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-56-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-54-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-53-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-51-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-47-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-45-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-46-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-44-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-42-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-41-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-40-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-38-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-37-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-36-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-35-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-33-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-32-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-31-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-29-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-27-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-28-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-25-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-66-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-23-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-65-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-24-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-60-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-57-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-55-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-22-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-52-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-50-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-20-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-19-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-43-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-17-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-39-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-16-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-34-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-30-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-26-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-13-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-21-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-18-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-15-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-14-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-11-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-10-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-8-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-7-0x0000000002D40000-0x0000000003D40000-memory.dmp

Filesize
16.0MB

Download
memory/2964-106-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download