modiloader | d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c

General

Target

d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe
Size

500KB
MD5

a642f65fbbc8014c4a6f3a7f11c5d60c
SHA1

a0ef7d45c145b8936f953acb3aa34eaf905d68fb
SHA256

d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c
SHA512

5ba39ad20d2e1e23dc8e05af0449f9e7da126a11bb43fab9bc805a2baac81f7531e4efb0001caec8ee42310d8b7749b5a96307f52f1abc8bd1641e7f525c98fd
SSDEEP

12288:CR1qw2pfw2eJfXv9BkHe7qHLb+ib9RF1Acx5UEDqPI:CRWpfwHJflP2rb+k93Oc9

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/848-56-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2
behavioral1/memory/848-57-0x0000000000401000-0x000000000049B000-memory.dmp	modiloader_stage2
behavioral1/memory/848-58-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2
behavioral1/memory/848-65-0x0000000002F50000-0x000000000308F000-memory.dmp	modiloader_stage2
behavioral1/memory/1168-66-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2
behavioral1/memory/848-68-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2
behavioral1/memory/1168-69-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

jkdu360.exe

pid process

1168 jkdu360.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

668 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe

pid process

848 d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe

pid	process
1168	jkdu360.exe

pid	process
668	cmd.exe

pid	process
848	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe

Drops file in Program Files directory 2 IoCs

Processes:

d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe

description	ioc	process
File created	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe

description	pid	process	target process
PID 848 wrote to memory of 1168	848	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	jkdu360.exe
PID 848 wrote to memory of 1168	848	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	jkdu360.exe
PID 848 wrote to memory of 1168	848	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	jkdu360.exe
PID 848 wrote to memory of 1168	848	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	jkdu360.exe
PID 848 wrote to memory of 668	848	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	cmd.exe
PID 848 wrote to memory of 668	848	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	cmd.exe
PID 848 wrote to memory of 668	848	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	cmd.exe
PID 848 wrote to memory of 668	848	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe
"C:\Users\Admin\AppData\Local\Temp\d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:848

C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe
C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe
2⤵
- Executes dropped EXE
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe"
2⤵
- Deletes itself
PID:668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe
Filesize
500KB

MD5
a642f65fbbc8014c4a6f3a7f11c5d60c

SHA1
a0ef7d45c145b8936f953acb3aa34eaf905d68fb

SHA256
d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c

SHA512
5ba39ad20d2e1e23dc8e05af0449f9e7da126a11bb43fab9bc805a2baac81f7531e4efb0001caec8ee42310d8b7749b5a96307f52f1abc8bd1641e7f525c98fd

Download Submit
\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe
Filesize
500KB

MD5
a642f65fbbc8014c4a6f3a7f11c5d60c

SHA1
a0ef7d45c145b8936f953acb3aa34eaf905d68fb

SHA256
d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c

SHA512
5ba39ad20d2e1e23dc8e05af0449f9e7da126a11bb43fab9bc805a2baac81f7531e4efb0001caec8ee42310d8b7749b5a96307f52f1abc8bd1641e7f525c98fd

Download Submit
memory/668-67-0x0000000000000000-mapping.dmp

Download
memory/848-55-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/848-56-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/848-57-0x0000000000401000-0x000000000049B000-memory.dmp

Filesize
616KB

Download
memory/848-58-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/848-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/848-65-0x0000000002F50000-0x000000000308F000-memory.dmp

Filesize
1.2MB

Download
memory/848-68-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/1168-60-0x0000000000000000-mapping.dmp

Download
memory/1168-66-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/1168-69-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads