modiloader | 85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf

Analysis

max time kernel
153s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 09:11

Target

85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe
Size

761KB
MD5

544a061f059f2fcc50adc96fb94dc666
SHA1

b5f4ad53fa0296d9bf148181665d8830df83fd43
SHA256

85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf
SHA512

a3c02c254537a57e5f02af0f015ff3b873b5aba9dd8db67bee6cc04ba9fa298fee935d9d16779a781a0257e1ebf2c80436bfd7d4d530b3f575ded4b266166f76
SSDEEP

12288:A3MrNCgKknRVJdoWN2XkaJGjGlnNl8HzfhhHZyYF3Z4mxx+DqVTVOC:IgKkFdoWN20aJGyljchHZRQmXNVTz

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2688-133-0x0000000000400000-0x0000000000580000-memory.dmp	modiloader_stage2

Drops file in Windows directory 1 IoCs

Processes:

85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe

description ioc process

File created C:\Windows\FieleWay.txt 85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4984 2688 WerFault.exe 85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe

description	ioc	process
File created	C:\Windows\FieleWay.txt	85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe

pid	pid_target	process	target process
4984	2688	WerFault.exe	85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe

description	pid	process	target process
PID 2688 wrote to memory of 4936	2688	85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe	IEXPLORE.EXE
PID 2688 wrote to memory of 4936	2688	85d0344bb793d1b37473979c9fbb2e4e2541377e5c69f838481a7a16118d2acf.exe	IEXPLORE.EXE

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 324
2⤵
- Program crash
PID:4984

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2688 -ip 2688
1⤵
PID:1556

memory/2688-132-0x0000000000400000-0x0000000000580000-memory.dmp

Filesize
1.5MB

Download
memory/2688-133-0x0000000000400000-0x0000000000580000-memory.dmp

Filesize
1.5MB

Download
memory/2688-134-0x0000000000A60000-0x0000000000AB4000-memory.dmp

Filesize
336KB

Download