modiloader | 54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821

General

Target

54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
Size

116KB
MD5

029775b5a472bee3c79941b845fc0b5b
SHA1

5e116f4f87561508dbe91b226c269c8a39229c5c
SHA256

54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821
SHA512

9af546fc405f6e862c5aa0e6964bd715828a23761b970e53f3b85f26eeba3b3a3c7828038b8e0ac51847487d36fc69e56c5112ec23e39f8e623541e4386caff9
SSDEEP

3072:wDCuZBX8l4kQZbXQRH2mlj7ud7s01Db2x:wDCa245Zb2WW6dY0Jb

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1884-63-0x0000000040010000-0x000000004004B000-memory.dmp	modiloader_stage2
behavioral1/memory/1884-64-0x0000000040010000-0x000000004004B000-memory.dmp	modiloader_stage2
behavioral1/memory/1884-65-0x0000000040010000-0x000000004004B000-memory.dmp	modiloader_stage2

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/864-58-0x0000000040010000-0x000000004004B000-memory.dmp	upx
behavioral1/memory/1884-63-0x0000000040010000-0x000000004004B000-memory.dmp	upx
behavioral1/memory/1884-64-0x0000000040010000-0x000000004004B000-memory.dmp	upx
behavioral1/memory/1884-65-0x0000000040010000-0x000000004004B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe

C:\Users\Admin\AppData\Local\Temp\54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
"C:\Users\Admin\AppData\Local\Temp\54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:864

C:\Users\Admin\AppData\Local\Temp\54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
"C:\Users\Admin\AppData\Local\Temp\54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe"
2⤵
PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/864-58-0x0000000040010000-0x000000004004B000-memory.dmp

Filesize
236KB

Download
memory/1884-56-0x0000000000000000-mapping.dmp

Download
memory/1884-61-0x0000000040010000-0x000000004004B000-memory.dmp

Filesize
236KB

Download
memory/1884-63-0x0000000040010000-0x000000004004B000-memory.dmp

Filesize
236KB

Download
memory/1884-64-0x0000000040010000-0x000000004004B000-memory.dmp

Filesize
236KB

Download
memory/1884-65-0x0000000040010000-0x000000004004B000-memory.dmp

Filesize
236KB

Download

description	pid	process	target process
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe
PID 864 wrote to memory of 1884	864	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe	54be0cd50f637dbcbfbee55db4cb5675fde043e50606af9e561d6ad3690d6821.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads