modiloader | e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783

Analysis

max time kernel
45s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 11:58

Target

e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe
Size

111KB
MD5

19afdf4e606d1833a1f8586806c1e298
SHA1

e31bc76f044917eaa6bd83ce48833cde2012ffcf
SHA256

e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783
SHA512

3c0d64454a99a7d7ab8db9b39d7181b286a4c8bffe080bd8191c00e04ba575e75387799365ecb4dd961ed934030be00b94cd94d6d8febc62decca51ad4b5ba61
SSDEEP

3072:S1+MJKrUnFYY5z7i0Nmbi5fJBNPhkout:SIrP90NmWtNyoS

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1340-56-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1340-56-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1768 1340 WerFault.exe e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe

pid	pid_target	process	target process
1768	1340	WerFault.exe	e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe

description	pid	process	target process
PID 1340 wrote to memory of 1768	1340	e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe	WerFault.exe
PID 1340 wrote to memory of 1768	1340	e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe	WerFault.exe
PID 1340 wrote to memory of 1768	1340	e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe	WerFault.exe
PID 1340 wrote to memory of 1768	1340	e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe
"C:\Users\Admin\AppData\Local\Temp\e1a8b0abc42484218b1d6ff65a21f14b6fcd0018448d2c275483cdf52d8ed783.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 204
2⤵
- Program crash
PID:1768

memory/1340-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1340-56-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1768-55-0x0000000000000000-mapping.dmp

Download