modiloader | 69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a

Analysis

max time kernel
125s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 03:41

Target

69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe
Size

682KB
MD5

8e63fd2f30618074212c6c826616a05b
SHA1

6d0851c24fdb15c4986886c003a71f555d416f95
SHA256

69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a
SHA512

11e8d1994cb7f885c7838b0c3a91824ab8329dcd55740c805a43f4231fe8144c9de1fc66df4016527ae242532f819ef35d08fd9cffae33f913f53e9f1ada30bb
SSDEEP

12288:ptmRDGRrvMYDiLnqupoz+kBsZmjsOsTEAZH1twM/Iv0MfTPi:DEDwvMYe2uazyYA7oAzFMfT6

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000054a8-55.dat	modiloader_stage2
behavioral1/files/0x000c0000000054a8-57.dat	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
916	Adobe.exe

Deletes itself 1 IoCs

pid	Process
1064	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
768	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 916	768	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	27
PID 768 wrote to memory of 916	768	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	27
PID 768 wrote to memory of 916	768	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	27
PID 768 wrote to memory of 916	768	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	27
PID 768 wrote to memory of 1064	768	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	28
PID 768 wrote to memory of 1064	768	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	28
PID 768 wrote to memory of 1064	768	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	28
PID 768 wrote to memory of 1064	768	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	28

C:\Users\Admin\AppData\Local\Temp\69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe
"C:\Users\Admin\AppData\Local\Temp\69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:768
- C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe
  C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe"
  2⤵
  - Deletes itself
  PID:1064

C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe

Filesize
682KB

MD5
8e63fd2f30618074212c6c826616a05b

SHA1
6d0851c24fdb15c4986886c003a71f555d416f95

SHA256
69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a

SHA512
11e8d1994cb7f885c7838b0c3a91824ab8329dcd55740c805a43f4231fe8144c9de1fc66df4016527ae242532f819ef35d08fd9cffae33f913f53e9f1ada30bb

Download Submit
\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe

Filesize
682KB

MD5
8e63fd2f30618074212c6c826616a05b

SHA1
6d0851c24fdb15c4986886c003a71f555d416f95

SHA256
69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a

SHA512
11e8d1994cb7f885c7838b0c3a91824ab8329dcd55740c805a43f4231fe8144c9de1fc66df4016527ae242532f819ef35d08fd9cffae33f913f53e9f1ada30bb

Download Submit
memory/768-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/916-56-0x0000000000000000-mapping.dmp

Download
memory/1064-59-0x0000000000000000-mapping.dmp

Download