modiloader | 74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6

Analysis

max time kernel
3s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 12:00

Target

74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe
Size

864KB
MD5

86536aae7f4423d73e30f123e5f4aeca
SHA1

452e9b9cad57afa7770045d87f48de20bd024606
SHA256

74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6
SHA512

fbb7efd4d8539acd665236522a7fef7934db937be89a62e1df519b7da6ad9738d62230e278ff1d43efe59371ffaea0424109bfc55fee051f5e8bb5d6f647656e
SSDEEP

24576:UFxc7PSIxAhDPpCpRuwWLifTn3UEOrlZj9:Ub+AhbkrfWLOTn3hOrLJ

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\gqkA43C.tmp	acprotect

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1420-55-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2
behavioral1/memory/1420-57-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2

Loads dropped DLL 1 IoCs

Processes:

74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe

pid process

1420 74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe
Drops file in Program Files directory 1 IoCs

Processes:

74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe

description ioc process

File created C:\PROGRA~1\2012.txt 74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe

pid process

1420 74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe

pid	process
1420	74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe

description	ioc	process
File created	C:\PROGRA~1\2012.txt	74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe

pid	process
1420	74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe

description	pid	process	target process
PID 1420 wrote to memory of 1984	1420	74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe	IEXPLORE.EXE
PID 1420 wrote to memory of 1984	1420	74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe	IEXPLORE.EXE
PID 1420 wrote to memory of 1984	1420	74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe	IEXPLORE.EXE
PID 1420 wrote to memory of 1984	1420	74b31a35ac8b66192f0452f47d5c73f455ed2b8ba06d1eb9179cefaff8a98bf6.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:1984

\Users\Admin\AppData\Local\Temp\gqkA43C.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1420-55-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1420-54-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1420-57-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1420-58-0x0000000000380000-0x00000000003F3000-memory.dmp

Filesize
460KB

Download