modiloader | b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
Size

475KB
MD5

2ee6eca90ed4186feb0eeb73a21050b5
SHA1

56fb41bddb1d65e30addd5f8e6eb4f31e4afe888
SHA256

b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3
SHA512

e5d070e0b24d03cde6e6221d0b6c27061c6889f3129d8d78f0b60d314d025c4a4deac99e4c926fe332aefa81be730a211a36ce204bcb4447faf76a25d6d35a70
SSDEEP

6144:kqwX56LLhzK5q8lVoYWLbTUrUPb534xff0mvuVwZO1zUwDqpKiPBlz96OdgNLKi1:kqoQdUnXWLPUrUjFCfS8ESzX41

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4920-138-0x0000000000010000-0x0000000000288000-memory.dmp	modiloader_stage2
behavioral2/memory/2144-140-0x0000000000010000-0x0000000000270000-memory.dmp	modiloader_stage2
behavioral2/memory/2144-142-0x0000000000010000-0x0000000000270000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

Processes:

b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe

description	pid	process	target process
PID 4920 set thread context of 2144	4920	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exeb0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe

description	pid	process	target process
PID 4920 wrote to memory of 2144	4920	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 4920 wrote to memory of 2144	4920	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 4920 wrote to memory of 2144	4920	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 4920 wrote to memory of 2144	4920	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 4920 wrote to memory of 2144	4920	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 4920 wrote to memory of 2144	4920	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 4920 wrote to memory of 2144	4920	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 4920 wrote to memory of 2144	4920	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 2144 wrote to memory of 2976	2144	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 2144 wrote to memory of 2976	2144	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
PID 2144 wrote to memory of 2976	2144	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe	b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe

C:\Users\Admin\AppData\Local\Temp\b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
"C:\Users\Admin\AppData\Local\Temp\b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
  C:\Users\Admin\AppData\Local\Temp\b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
    C:\Users\Admin\AppData\Local\Temp\b0a2b4457437a4a4aaff0305753b6302cd9cae914de18d53a20003c2bfbe8ac3.exe
    3⤵
    PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-132-0x0000000000000000-mapping.dmp

Download
memory/2144-133-0x0000000000010000-0x0000000000270000-memory.dmp

Filesize
2.4MB

Download
memory/2144-134-0x0000000000010000-0x0000000000270000-memory.dmp

Filesize
2.4MB

Download
memory/2144-135-0x0000000000010000-0x0000000000270000-memory.dmp

Filesize
2.4MB

Download
memory/2144-139-0x0000000000010000-0x0000000000270000-memory.dmp

Filesize
2.4MB

Download
memory/2144-140-0x0000000000010000-0x0000000000270000-memory.dmp

Filesize
2.4MB

Download
memory/2144-142-0x0000000000010000-0x0000000000270000-memory.dmp

Filesize
2.4MB

Download
memory/2976-141-0x0000000000000000-mapping.dmp

Download
memory/4920-138-0x0000000000010000-0x0000000000288000-memory.dmp

Filesize
2.5MB

Download