modiloader | 85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf

Analysis

max time kernel
40s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 09:11

Target

85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe
Size

761KB
MD5

544a061f059f2fcc50adc96fb94dc666
SHA1

b5f4ad53fa0296d9bf148181665d8830df83fd43
SHA256

85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf
SHA512

a3c02c254537a57e5f02af0f015ff3b873b5aba9dd8db67bee6cc04ba9fa298fee935d9d16779a781a0257e1ebf2c80436bfd7d4d530b3f575ded4b266166f76
SSDEEP

12288:A3MrNCgKknRVJdoWN2XkaJGjGlnNl8HzfhhHZyYF3Z4mxx+DqVTVOC:IgKkFdoWN20aJGyljchHZRQmXNVTz

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1716-57-0x0000000000400000-0x0000000000580000-memory.dmp	modiloader_stage2

Drops file in Windows directory 1 IoCs

Processes:

85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe

description ioc process

File created C:\Windows\FieleWay.txt 85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe

description	ioc	process
File created	C:\Windows\FieleWay.txt	85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe

description	pid	process	target process
PID 1716 wrote to memory of 936	1716	85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe	IEXPLORE.EXE
PID 1716 wrote to memory of 936	1716	85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe	IEXPLORE.EXE
PID 1716 wrote to memory of 936	1716	85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe	IEXPLORE.EXE
PID 1716 wrote to memory of 936	1716	85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:936

memory/1716-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1716-55-0x0000000000400000-0x0000000000580000-memory.dmp

Filesize
1.5MB

Download
memory/1716-56-0x0000000000340000-0x0000000000394000-memory.dmp

Filesize
336KB

Download
memory/1716-57-0x0000000000400000-0x0000000000580000-memory.dmp

Filesize
1.5MB

Download