modiloader | 63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 15:43

Target

63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e.exe
Size

124KB
MD5

0f5db1b3a92112e3e7f103c4fd9312e0
SHA1

5d29d966a0b76b88d7c39803bf3a1e99dfb93786
SHA256

63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e
SHA512

a06923c42d019987d70e885f1f614b65ed2fe880ec4cc3409a0e564a107479d0591ede42ff6e0d5e4956f8c145e85efd3560be155b6d7c491c5cb396ec73d868
SSDEEP

3072:7LCnfuTStThRr7+O9ewqjXrbAJNN2a1h29Btxfmp9nEMRLx:7ktF57+O9YLAT0a1OPfm3nEqx

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000005c51-56.dat	modiloader_stage2
behavioral1/files/0x000a000000005c51-58.dat	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1128	apocalyps32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\apocalyps32.exe	63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e.exe
File opened for modification	C:\Windows\apocalyps32.exe	63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e.exe
File created	C:\Windows\apocalyps32.exe	apocalyps32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1128	2016	63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e.exe	26
PID 2016 wrote to memory of 1128	2016	63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e.exe	26
PID 2016 wrote to memory of 1128	2016	63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e.exe	26
PID 2016 wrote to memory of 1128	2016	63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e.exe	26
PID 1128 wrote to memory of 828	1128	apocalyps32.exe	27
PID 1128 wrote to memory of 828	1128	apocalyps32.exe	27
PID 1128 wrote to memory of 828	1128	apocalyps32.exe	27
PID 1128 wrote to memory of 828	1128	apocalyps32.exe	27

C:\Windows\apocalyps32.exe

Filesize
124KB

MD5
0f5db1b3a92112e3e7f103c4fd9312e0

SHA1
5d29d966a0b76b88d7c39803bf3a1e99dfb93786

SHA256
63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e

SHA512
a06923c42d019987d70e885f1f614b65ed2fe880ec4cc3409a0e564a107479d0591ede42ff6e0d5e4956f8c145e85efd3560be155b6d7c491c5cb396ec73d868

Download Submit
C:\Windows\apocalyps32.exe

Filesize
124KB

MD5
0f5db1b3a92112e3e7f103c4fd9312e0

SHA1
5d29d966a0b76b88d7c39803bf3a1e99dfb93786

SHA256
63b64880047c8956e67e9339cfcd430ab5b683bbef3631eea5a56827abed8b2e

SHA512
a06923c42d019987d70e885f1f614b65ed2fe880ec4cc3409a0e564a107479d0591ede42ff6e0d5e4956f8c145e85efd3560be155b6d7c491c5cb396ec73d868

Download Submit
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download