modiloader | 69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a

Analysis

max time kernel
265s
max time network
280s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 03:41

Target

69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe
Size

682KB
MD5

8e63fd2f30618074212c6c826616a05b
SHA1

6d0851c24fdb15c4986886c003a71f555d416f95
SHA256

69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a
SHA512

11e8d1994cb7f885c7838b0c3a91824ab8329dcd55740c805a43f4231fe8144c9de1fc66df4016527ae242532f819ef35d08fd9cffae33f913f53e9f1ada30bb
SSDEEP

12288:ptmRDGRrvMYDiLnqupoz+kBsZmjsOsTEAZH1twM/Iv0MfTPi:DEDwvMYe2uazyYA7oAzFMfT6

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000022da7-133.dat	modiloader_stage2
behavioral2/files/0x0009000000022da7-134.dat	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1020	Adobe.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1020	3508	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	81
PID 3508 wrote to memory of 1020	3508	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	81
PID 3508 wrote to memory of 1020	3508	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	81
PID 3508 wrote to memory of 4380	3508	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	82
PID 3508 wrote to memory of 4380	3508	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	82
PID 3508 wrote to memory of 4380	3508	69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe	82

C:\Users\Admin\AppData\Local\Temp\69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe
"C:\Users\Admin\AppData\Local\Temp\69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3508
- C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe
  C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a.exe"
  2⤵
  PID:4380

C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\Adobe.exe

Filesize
682KB

MD5
8e63fd2f30618074212c6c826616a05b

SHA1
6d0851c24fdb15c4986886c003a71f555d416f95

SHA256
69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a

SHA512
11e8d1994cb7f885c7838b0c3a91824ab8329dcd55740c805a43f4231fe8144c9de1fc66df4016527ae242532f819ef35d08fd9cffae33f913f53e9f1ada30bb

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\Adobe.exe

Filesize
682KB

MD5
8e63fd2f30618074212c6c826616a05b

SHA1
6d0851c24fdb15c4986886c003a71f555d416f95

SHA256
69388b3cef14a0d87015bc6c0a1e1240a53bd816ace5788272748940ad10891a

SHA512
11e8d1994cb7f885c7838b0c3a91824ab8329dcd55740c805a43f4231fe8144c9de1fc66df4016527ae242532f819ef35d08fd9cffae33f913f53e9f1ada30bb

Download Submit