modiloader | 7629f878ba09da98ec0fa56671804eb22e38ffbd310e406e112cf365264c713d

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 15:22

Target
HFSKY高校实验中心教学管理系统/setup.exe
Size 6.4MB
Sample240621-ssaymsvhph
SHA256 5cd65c4bb03b931a5c49eef70fd411e70880f176fd0628bc35fb74f8207b8605
MD5 6be87553acd8d7442c636d1728196676
SHA1 c44027eedf47828906a6649ed66b6e5f7db2f30c
SHA512 7acff0f04fc021f6a2358fd0c769635054c01c1c3823555486eeec9e9e117ed9fd22e31c532f38cc09fc016a03e28cbda1824ec38ce7328557f59cd3a860eb11
SSDEEP 196608:K1KPeka6oPZfHCUUnZxlIji9dxNzSrIF6I4O0:boPpKIG9dHuIb0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral2/memory/1476-1-0x0000000000400000-0x0000000000580000-memory.dmp	modiloader_stage1
behavioral2/memory/1476-2-0x0000000000400000-0x0000000000580000-memory.dmp	modiloader_stage1

C:\Users\Admin\AppData\Local\Temp\HFSKY高校实验中心教学管理系统\setup.exe
"C:\Users\Admin\AppData\Local\Temp\HFSKY高校实验中心教学管理系统\setup.exe"
1⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1752

memory/1476-0-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/1476-1-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1476-2-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1476-3-0x0000000000740000-0x0000000000741000-memory.dmp

Download