modiloader | deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a

General

Target

deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
Size

791KB
MD5

aec67993a8232e61da7b1751a67db85a
SHA1

857e0518708fd9487e8d26ff1f88d2ddbaf50647
SHA256

deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a
SHA512

4107b556d0bb81ca2079e5ac342ddaac0e5219d5371bafb321d09814d05a5316843d3c96dc8ec6b5db525b4a7fbf62d5008a251c16b728ad52502fb1a8b6c19e
SSDEEP

24576:I93b7fS/pZYrJZ6/3S50kVZXHGMOA0y92ULl:I93b7fOperJZo3ALZOJQLl

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1656-57-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/1656-59-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/1656-61-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/1656-62-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/1656-64-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/1656-66-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/1656-67-0x0000000000498BEC-mapping.dmp	modiloader_stage2
behavioral1/memory/1656-70-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/1656-71-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/1656-72-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

Processes:

deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe

description	pid	process	target process
PID 1620 set thread context of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe

Drops file in Program Files directory 1 IoCs

Processes:

deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exedeeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe

C:\Users\Admin\AppData\Local\Temp\deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
"C:\Users\Admin\AppData\Local\Temp\deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1620

C:\Users\Admin\AppData\Local\Temp\deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
C:\Users\Admin\AppData\Local\Temp\deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1656

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
3⤵
PID:1312

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-54-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-55-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-57-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-59-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-61-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-62-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-64-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-66-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-67-0x0000000000498BEC-mapping.dmp

Download
memory/1656-69-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1656-70-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-71-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1656-72-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download

description	pid	process	target process
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1620 wrote to memory of 1656	1620	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe
PID 1656 wrote to memory of 1312	1656	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 1312	1656	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 1312	1656	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 1312	1656	deeee4047e0c72a4a6b3ee3c3e472d545780a961d3c6e454b61771df62c1826a.exe	IEXPLORE.EXE

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads