modiloader | d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c

Analysis

max time kernel
165s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 16:45

Target

d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe
Size

500KB
MD5

a642f65fbbc8014c4a6f3a7f11c5d60c
SHA1

a0ef7d45c145b8936f953acb3aa34eaf905d68fb
SHA256

d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c
SHA512

5ba39ad20d2e1e23dc8e05af0449f9e7da126a11bb43fab9bc805a2baac81f7531e4efb0001caec8ee42310d8b7749b5a96307f52f1abc8bd1641e7f525c98fd
SSDEEP

12288:CR1qw2pfw2eJfXv9BkHe7qHLb+ib9RF1Acx5UEDqPI:CRWpfwHJflP2rb+k93Oc9

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/752-132-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2
behavioral2/memory/752-133-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2
behavioral2/memory/752-134-0x0000000000401000-0x000000000049B000-memory.dmp	modiloader_stage2
behavioral2/memory/752-141-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2
behavioral2/memory/3580-142-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2
behavioral2/memory/3580-143-0x0000000000400000-0x000000000053F000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

jkdu360.exe

pid process

3580 jkdu360.exe

pid	process
3580	jkdu360.exe

Drops file in Program Files directory 2 IoCs

Processes:

d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe

description	ioc	process
File created	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe

description	pid	process	target process
PID 752 wrote to memory of 3580	752	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	jkdu360.exe
PID 752 wrote to memory of 3580	752	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	jkdu360.exe
PID 752 wrote to memory of 3580	752	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	jkdu360.exe
PID 752 wrote to memory of 2972	752	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	cmd.exe
PID 752 wrote to memory of 2972	752	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	cmd.exe
PID 752 wrote to memory of 2972	752	d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe
"C:\Users\Admin\AppData\Local\Temp\d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:752
- C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe
  C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c.exe"
  2⤵
  PID:2972

C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\jkdu360.exe

Filesize
500KB

MD5
a642f65fbbc8014c4a6f3a7f11c5d60c

SHA1
a0ef7d45c145b8936f953acb3aa34eaf905d68fb

SHA256
d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c

SHA512
5ba39ad20d2e1e23dc8e05af0449f9e7da126a11bb43fab9bc805a2baac81f7531e4efb0001caec8ee42310d8b7749b5a96307f52f1abc8bd1641e7f525c98fd

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\jkdu360.exe

Filesize
500KB

MD5
a642f65fbbc8014c4a6f3a7f11c5d60c

SHA1
a0ef7d45c145b8936f953acb3aa34eaf905d68fb

SHA256
d9dd70907d2306c083044a5aafa0fff7cf5dab0ddb3a99c77ca65557b78c6a3c

SHA512
5ba39ad20d2e1e23dc8e05af0449f9e7da126a11bb43fab9bc805a2baac81f7531e4efb0001caec8ee42310d8b7749b5a96307f52f1abc8bd1641e7f525c98fd

Download Submit
memory/752-132-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/752-133-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/752-134-0x0000000000401000-0x000000000049B000-memory.dmp

Filesize
616KB

Download
memory/752-141-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/2972-140-0x0000000000000000-mapping.dmp

Download
memory/3580-135-0x0000000000000000-mapping.dmp

Download
memory/3580-142-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/3580-143-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download