modiloader | b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d

Analysis

max time kernel
259s
max time network
344s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 09:20

Target

b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe
Size

98KB
MD5

723b02c76065004831ab9e96b66419ee
SHA1

327e7dd8ce42f9a18980629c692cbfffebc6d15a
SHA256

b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d
SHA512

24c520aeaa5171d3a5f25e50f68e835e22a503fc2b16ef98b0816c3e475eb03aa4c4557cd069c5af9da53f0f7c1428a4f0db65432db1bbecffb1f95895f7d40f
SSDEEP

1536:kk3vzKr0uisCV0MC5LEklb0TbTFbQXKI5jQGFMA0OtbPtMxmg6ntxgMuTVRG:N39ui/WLEkxWfFbKKKlDrtMonXDg

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1412-136-0x0000000000010000-0x0000000000036000-memory.dmp	modiloader_stage2
behavioral2/memory/4632-137-0x0000000000010000-0x0000000000036000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

apocalyps32.exe

pid process

4632 apocalyps32.exe

pid	process
4632	apocalyps32.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1412-132-0x0000000000010000-0x0000000000036000-memory.dmp	upx
C:\Windows\apocalyps32.exe	upx
behavioral2/memory/1412-136-0x0000000000010000-0x0000000000036000-memory.dmp	upx
C:\Windows\apocalyps32.exe	upx
behavioral2/memory/4632-137-0x0000000000010000-0x0000000000036000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exeapocalyps32.exe

description	ioc	process
File created	C:\Windows\apocalyps32.exe	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe
File opened for modification	C:\Windows\apocalyps32.exe	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe
File created	C:\Windows\apocalyps32.exe	apocalyps32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exeapocalyps32.exe

description	pid	process	target process
PID 1412 wrote to memory of 4632	1412	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe	apocalyps32.exe
PID 1412 wrote to memory of 4632	1412	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe	apocalyps32.exe
PID 1412 wrote to memory of 4632	1412	b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d.exe	apocalyps32.exe
PID 4632 wrote to memory of 3952	4632	apocalyps32.exe	msedge.exe
PID 4632 wrote to memory of 3952	4632	apocalyps32.exe	msedge.exe

C:\Windows\apocalyps32.exe
Filesize
98KB

MD5
723b02c76065004831ab9e96b66419ee

SHA1
327e7dd8ce42f9a18980629c692cbfffebc6d15a

SHA256
b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d

SHA512
24c520aeaa5171d3a5f25e50f68e835e22a503fc2b16ef98b0816c3e475eb03aa4c4557cd069c5af9da53f0f7c1428a4f0db65432db1bbecffb1f95895f7d40f

Download Submit
C:\Windows\apocalyps32.exe
Filesize
98KB

MD5
723b02c76065004831ab9e96b66419ee

SHA1
327e7dd8ce42f9a18980629c692cbfffebc6d15a

SHA256
b3a0b7fa8ae2ca1c673f0d57d7f12ee66886dc8f90a1dfa27114588c890e0d6d

SHA512
24c520aeaa5171d3a5f25e50f68e835e22a503fc2b16ef98b0816c3e475eb03aa4c4557cd069c5af9da53f0f7c1428a4f0db65432db1bbecffb1f95895f7d40f

Download Submit
memory/1412-132-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download
memory/1412-136-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download
memory/3952-138-0x0000000000000000-mapping.dmp

Download
memory/4632-133-0x0000000000000000-mapping.dmp

Download
memory/4632-137-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download