modiloader | ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b

General

Target

ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
Size

475KB
MD5

0b73d3962bbd27ee3f70bbebee77244c
SHA1

b4d4f012b3f8c6646cb4fa833b8b701ab0b45ccc
SHA256

ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b
SHA512

96d266951a425baa0b57f53a1b140ffa0b62486ec19e1712d0964ddf144ac7268f27f13120c93266d0aac39bf6c503a045f31e01bada26b74b0d7a8629f0c9f4
SSDEEP

12288:T4rGXfxwa6w3xdjNrfPnh7D4pBryA+Z2+Y1mGzVKEU:TTvj3PprfPnl4pM12L1mGzVNU

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-59-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/2036-61-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/2036-63-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/2036-64-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/2036-66-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/2036-67-0x0000000000498FB4-mapping.dmp	modiloader_stage2
behavioral1/memory/2036-68-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/2036-71-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/2036-72-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/2036-73-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

Processes:

ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe

description ioc process

File created C:\Windows\SysWOW64\SetupWay.txt ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\SetupWay.txt	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe

description	pid	process	target process
PID 916 set thread context of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe

pid process

916 ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe

pid	process
916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exeed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe

C:\Users\Admin\AppData\Local\Temp\ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
"C:\Users\Admin\AppData\Local\Temp\ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Admin\AppData\Local\Temp\ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
C:\Users\Admin\AppData\Local\Temp\ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2036

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
3⤵
PID:1724

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-69-0x0000000000400000-0x00000000004F1D55-memory.dmp

Filesize
967KB

Download
memory/2036-61-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-59-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-56-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-63-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-64-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-66-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-67-0x0000000000498FB4-mapping.dmp

Download
memory/2036-68-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-57-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-70-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/2036-71-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-72-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2036-73-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download

description	pid	process	target process
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 916 wrote to memory of 2036	916	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe
PID 2036 wrote to memory of 1724	2036	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	IEXPLORE.EXE
PID 2036 wrote to memory of 1724	2036	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	IEXPLORE.EXE
PID 2036 wrote to memory of 1724	2036	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	IEXPLORE.EXE
PID 2036 wrote to memory of 1724	2036	ed1a9602db067a50b7884e3b36b1e365835d0ea257f88f242c120610150bd22b.exe	IEXPLORE.EXE

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads