modiloader | fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0

General

Target

fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
Size

907KB
MD5

3a2b63625c8862931ea83ff11b5abdcf
SHA1

a5c02926be0c3bbc7de38094e15b6016f44b9db0
SHA256

fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0
SHA512

bddf58ca57f103d79ab2cf7a86f62557e941cfb82889a5c6b4c6bf7ead835b74f633287ba8fe6ac65d36a6b36dbf1213d1c46bf21b5bb376d758afe309ca33c7
SSDEEP

24576:IlHxz7GCocgyvVZVYkt94P3LXb7WsT2Zmz:yRW6gyrGB3jvWsT2Zk

Score

10^/10

modiloader trojan vmprotect

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1360-59-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2
behavioral1/memory/1360-65-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2
behavioral1/memory/1200-64-0x0000000002330000-0x00000000024E2000-memory.dmp	modiloader_stage2
behavioral1/memory/1360-68-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2
behavioral1/memory/1360-70-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2
behavioral1/memory/1360-73-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2
behavioral1/memory/1360-76-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1200-54-0x00000000000D0000-0x0000000000282000-memory.dmp	vmprotect
behavioral1/memory/1200-60-0x00000000000D0000-0x0000000000282000-memory.dmp	vmprotect

Suspicious use of SetThreadContext 1 IoCs

Processes:

fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe

description	pid	process	target process
PID 1200 set thread context of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe

description	pid	process	target process
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
PID 1200 wrote to memory of 1360	1200	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe	fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe

C:\Users\Admin\AppData\Local\Temp\fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
"C:\Users\Admin\AppData\Local\Temp\fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe
"C:\Users\Admin\AppData\Local\Temp\fea90aa0d2f7db26cf5c95b6b561e010a4aab9af7dfab89e8fa58e0b93b957f0.exe"
2⤵
PID:1360

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-62-0x0000000000590000-0x0000000000646000-memory.dmp

Filesize
728KB

Download
memory/1200-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1200-79-0x0000000000590000-0x0000000000646000-memory.dmp

Filesize
728KB

Download
memory/1200-54-0x00000000000D0000-0x0000000000282000-memory.dmp

Filesize
1.7MB

Download
memory/1200-60-0x00000000000D0000-0x0000000000282000-memory.dmp

Filesize
1.7MB

Download
memory/1200-64-0x0000000002330000-0x00000000024E2000-memory.dmp

Filesize
1.7MB

Download
memory/1360-57-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1360-65-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1360-59-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1360-68-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1360-70-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1360-73-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1360-76-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1360-78-0x00000000004BC000-mapping.dmp

Download
memory/1360-56-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads