modiloader | 6b53ba14172f0094a00edfef96887aab01e8b1c49bdc6b1f34d7f2e32f88d172

Analysis

Target
9f1f5ecb148e6e648a6a2466b29f7f2d.exe
Size 615KB
Sample201013-dce7rbzpya
SHA256 6b53ba14172f0094a00edfef96887aab01e8b1c49bdc6b1f34d7f2e32f88d172
MD5 9f1f5ecb148e6e648a6a2466b29f7f2d
SHA1 c7c0a7175a6a838348cc474b293c0847caf074b2
SHA512 fd692a7064922a4fa8630204d32ad000ef5d980da3c78f0c65fc66bd7732725800887682d72051a9c51cee99f3ed2b5a605d40204419bb6c018b6f7044e85901
MD5 SHA1 SHA512

Score

10^/10

trojan modiloader

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1304-0-0x0000000000260000-0x000000000026F000-memory.dmp	modiloader_stage1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	1304	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1884	1304	9f1f5ecb148e6e648a6a2466b29f7f2d.exe	30
PID 1304 wrote to memory of 1884	1304	9f1f5ecb148e6e648a6a2466b29f7f2d.exe	30
PID 1304 wrote to memory of 1884	1304	9f1f5ecb148e6e648a6a2466b29f7f2d.exe	30
PID 1304 wrote to memory of 1884	1304	9f1f5ecb148e6e648a6a2466b29f7f2d.exe	30

C:\Users\Admin\AppData\Local\Temp\9f1f5ecb148e6e648a6a2466b29f7f2d.exe
"C:\Users\Admin\AppData\Local\Temp\9f1f5ecb148e6e648a6a2466b29f7f2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 824
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884

memory/1304-0-0x0000000000260000-0x000000000026F000-memory.dmp

Download

memory/1616-1-0x000007FEF8550000-0x000007FEF87CA000-memory.dmp

Download

memory/1884-3-0x0000000000AF0000-0x0000000000B01000-memory.dmp

Download

memory/1884-4-0x0000000002770000-0x0000000002781000-memory.dmp

Download