modiloader | b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 09:20

Target

b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe
Size

98KB
MD5

723b02c76065004831ab9e96b66419ee
SHA1

327e7dd8ce42f9a18980629c692cbfffebc6d15a
SHA256

b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d
SHA512

24c520aeaa5171d3a5f25e50f68e835e22a503fc2b16ef98b0816c3e475eb03aa4c4557cd069c5af9da53f0f7c1428a4f0db65432db1bbecffb1f95895f7d40f
SSDEEP

1536:kk3vzKr0uisCV0MC5LEklb0TbTFbQXKI5jQGFMA0OtbPtMxmg6ntxgMuTVRG:N39ui/WLEkxWfFbKKKlDrtMonXDg

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1604-56-0x0000000000010000-0x0000000000036000-memory.dmp	modiloader_stage2
behavioral1/memory/972-60-0x0000000000010000-0x0000000000036000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

apocalyps32.exe

pid process

972 apocalyps32.exe

pid	process
972	apocalyps32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1604-56-0x0000000000010000-0x0000000000036000-memory.dmp	upx
C:\Windows\apocalyps32.exe	upx
C:\Windows\apocalyps32.exe	upx
behavioral1/memory/972-60-0x0000000000010000-0x0000000000036000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exeapocalyps32.exe

description	ioc	process
File opened for modification	C:\Windows\apocalyps32.exe	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe
File created	C:\Windows\apocalyps32.exe	apocalyps32.exe
File created	C:\Windows\apocalyps32.exe	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exeapocalyps32.exe

description	pid	process	target process
PID 1604 wrote to memory of 972	1604	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe	apocalyps32.exe
PID 1604 wrote to memory of 972	1604	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe	apocalyps32.exe
PID 1604 wrote to memory of 972	1604	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe	apocalyps32.exe
PID 1604 wrote to memory of 972	1604	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe	apocalyps32.exe
PID 972 wrote to memory of 592	972	apocalyps32.exe	iexplore.exe
PID 972 wrote to memory of 592	972	apocalyps32.exe	iexplore.exe
PID 972 wrote to memory of 592	972	apocalyps32.exe	iexplore.exe
PID 972 wrote to memory of 592	972	apocalyps32.exe	iexplore.exe

C:\Windows\apocalyps32.exe

Filesize
98KB

MD5
723b02c76065004831ab9e96b66419ee

SHA1
327e7dd8ce42f9a18980629c692cbfffebc6d15a

SHA256
b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d

SHA512
24c520aeaa5171d3a5f25e50f68e835e22a503fc2b16ef98b0816c3e475eb03aa4c4557cd069c5af9da53f0f7c1428a4f0db65432db1bbecffb1f95895f7d40f

Download Submit
C:\Windows\apocalyps32.exe

Filesize
98KB

MD5
723b02c76065004831ab9e96b66419ee

SHA1
327e7dd8ce42f9a18980629c692cbfffebc6d15a

SHA256
b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d

SHA512
24c520aeaa5171d3a5f25e50f68e835e22a503fc2b16ef98b0816c3e475eb03aa4c4557cd069c5af9da53f0f7c1428a4f0db65432db1bbecffb1f95895f7d40f

Download Submit
memory/972-55-0x0000000000000000-mapping.dmp

Download
memory/972-60-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download
memory/1604-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1604-56-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download