modiloader | 94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a

Analysis

max time kernel
39s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 05:56

Target

94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe
Size

712KB
MD5

203fddbd0b75333f7db1f3d371595bbc
SHA1

e75f0c5c6ed8a51b607c38d89d56376962e93c80
SHA256

94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a
SHA512

5756664110177d14ba9af821ec6d6f2ea4567bb6a26cbdc94db801b44ec946a2f9122349fe5349f9efb828272fddff6b2e20958317faf6adce406c2d98f6165e
SSDEEP

12288:O8IxrW1OFhEIHeaWoHjOyPydW1CG9n2kWzobqltbQOxzk0NwaY4YCpo7br:rWrWQFh/jXDL6XG92kQjQ6zk064YP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1128-56-0x0000000000400000-0x000000000056D000-memory.dmp	modiloader_stage2
behavioral1/memory/1128-55-0x0000000000400000-0x000000000056D000-memory.dmp	modiloader_stage2
behavioral1/memory/1128-58-0x0000000000400000-0x000000000056D000-memory.dmp	modiloader_stage2
behavioral1/memory/1128-59-0x0000000000400000-0x000000000056D000-memory.dmp	modiloader_stage2
behavioral1/memory/1128-61-0x0000000000400000-0x000000000056D000-memory.dmp	modiloader_stage2
behavioral1/memory/1128-62-0x0000000000400000-0x000000000056D000-memory.dmp	modiloader_stage2
behavioral1/memory/1128-63-0x0000000000400000-0x000000000056D000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

Processes:

94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt	94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe

description	pid	process	target process
PID 1128 wrote to memory of 556	1128	94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe	IEXPLORE.EXE
PID 1128 wrote to memory of 556	1128	94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe	IEXPLORE.EXE
PID 1128 wrote to memory of 556	1128	94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe	IEXPLORE.EXE
PID 1128 wrote to memory of 556	1128	94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe
"C:\Users\Admin\AppData\Local\Temp\94283fea132902835729de1dcd1fd8f8b370059bfd0d2a549677add87a59646a.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1128
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:556

memory/1128-54-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download
memory/1128-56-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download
memory/1128-55-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download
memory/1128-58-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download
memory/1128-59-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download
memory/1128-60-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1128-61-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download
memory/1128-62-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download
memory/1128-63-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download