modiloader | 1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c

Analysis

max time kernel
40s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 05:26

Target

1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe
Size

240KB
MD5

0d792ebd5e0fa3b261bfd8510bf42f40
SHA1

4331351d6baa7a79445f0237783dc7ceaa920368
SHA256

1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c
SHA512

19ee21ae2351ce26c3d7d0bbdcb3f6b77db633de2618b85cd8467577f2494c9afb303e9f492ba51dd8ad60b310b95430009deb0d7e6f48ff605055fd2c1de4f1
SSDEEP

3072:35uzHUxlP13hjPXTG55NTC20QmgEqrpSndQWAw/Qyq0Sjk64zltZm3StQQf:pi0t51Pq55NGSrpsdNiX0KatklO

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/1208-57-0x0000000000400000-0x0000000000435000-memory.dmp	modiloader_stage2
behavioral1/memory/1208-58-0x0000000000402E54-mapping.dmp	modiloader_stage2
behavioral1/memory/1208-63-0x0000000000400000-0x0000000000435000-memory.dmp	modiloader_stage2
behavioral1/memory/1208-65-0x0000000000440000-0x0000000000500000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 set thread context of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27
PID 1380 wrote to memory of 1208	1380	1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe	27

C:\Users\Admin\AppData\Local\Temp\1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe
"C:\Users\Admin\AppData\Local\Temp\1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe
  "C:\Users\Admin\AppData\Local\Temp\1d8a1845a1efcb46baaa1c9c858181792f51a10dab0e7bf8d4205024387fe14c.exe"
  2⤵
  PID:1208

memory/1208-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1208-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1208-65-0x0000000000440000-0x0000000000500000-memory.dmp

Filesize
768KB

Download
memory/1380-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download