modiloader | c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 18:26

Target

c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99.exe
Size

115KB
MD5

1f429a529acc1ad7ca1fb819a6a5733a
SHA1

88871dec03afce1e8db45bde0689c8490bd7bd4c
SHA256

c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99
SHA512

dd7eae1960d5f9d33bad205e859d79a99389aff378a50f500d3cb87e01404d94a086b2bab243c98be4cb3b217fd1d2f70759b5523d864a933d844d25d42a750c
SSDEEP

3072:euWjrWynrllnDIBlq7uanVmQmTyDdewN6v/pQ:n8ZrbI7MnPmcN6Xp

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2040-133-0x0000000000010000-0x00000000001CB000-memory.dmp	modiloader_stage2

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2040-133-0x0000000000010000-0x00000000001CB000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 5028	2040	c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99.exe	81
PID 2040 wrote to memory of 5028	2040	c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99.exe	81
PID 2040 wrote to memory of 5028	2040	c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99.exe	81

C:\Users\Admin\AppData\Local\Temp\c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99.exe
"C:\Users\Admin\AppData\Local\Temp\c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99.exe
  C:\Users\Admin\AppData\Local\Temp\c19e9328a0696d167d5074b516dee9e2b1271d5e799e21df2778a615249dee99.exe
  2⤵
  PID:5028

memory/2040-133-0x0000000000010000-0x00000000001CB000-memory.dmp

Filesize
1.7MB

Download