modiloader | 8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52

General

Target

8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
Size

853KB
MD5

5f29c6611f4a192554000d58c3fa09f6
SHA1

76e805b8a8cc69da456b99d8c5faec825727a717
SHA256

8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52
SHA512

9eae47da7dc3983ce71946cf3196510d9554cc8cf69bf5c906249a60ef261e91296db445a900b30ebea2b9f9bcb5a186d35e4810106aae501ce952177c725d57
SSDEEP

24576:NynWmKR11zmdvkCEMYSa9S+rXFb+Yo4AO7:sWbReWCEQM4oAK

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/780-59-0x0000000020000000-0x00000000200E3000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 2 IoCs

Processes:

8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe

description	pid	process	target process
PID 780 set thread context of 864	780	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 864 set thread context of 1728	864	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe

description	pid	process	target process
PID 780 wrote to memory of 864	780	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 780 wrote to memory of 864	780	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 780 wrote to memory of 864	780	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 780 wrote to memory of 864	780	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 780 wrote to memory of 864	780	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 780 wrote to memory of 864	780	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 864 wrote to memory of 1728	864	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 864 wrote to memory of 1728	864	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 864 wrote to memory of 1728	864	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 864 wrote to memory of 1728	864	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 864 wrote to memory of 1728	864	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
PID 864 wrote to memory of 1728	864	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe	8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe

C:\Users\Admin\AppData\Local\Temp\8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
"C:\Users\Admin\AppData\Local\Temp\8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:780

C:\Users\Admin\AppData\Local\Temp\8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
C:\Users\Admin\AppData\Local\Temp\8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864

C:\Users\Admin\AppData\Local\Temp\8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
C:\Users\Admin\AppData\Local\Temp\8252916a168931950b852a84f5fe74cf5256cfa5fcffbfe346f141f3b1f64a52.exe
3⤵
PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-59-0x0000000020000000-0x00000000200E3000-memory.dmp

Filesize
908KB

Download
memory/864-54-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/864-56-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/864-57-0x0000000010004020-mapping.dmp

Download
memory/864-58-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/864-60-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/864-65-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/1728-61-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1728-64-0x000000000040110C-mapping.dmp

Download
memory/1728-63-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads