modiloader | 90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 12:51

Target

90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exe
Size

255KB
MD5

2c7b17320e20fdaad9b82e6802b43d69
SHA1

98022315c931f275ec467534fc57452d742a82da
SHA256

90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97
SHA512

e79beaf703ce53b8faa4ba43b107691e07d7eeb331f5adc43ee10f74516994725efc271f9ce924921f7f25cb0b468f9b1a459c46e6aef65b5f0408f95ae3037a
SSDEEP

6144:q7WZh22Ltnko1hznaMnVDnqr8sevNgJZPKM9cQ:KWZIqJTnFVDnqw3lgbjh

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4204-132-0x0000000000400000-0x0000000000482000-memory.dmp	modiloader_stage2
behavioral2/memory/4204-134-0x0000000000400000-0x0000000000482000-memory.dmp	modiloader_stage2
behavioral2/memory/2116-136-0x0000000000400000-0x0000000000482000-memory.dmp	modiloader_stage2

Modifies registry class 6 IoCs

Processes:

90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	svchost.exe

Suspicious behavior: RenamesItself 2 IoCs

Processes:

90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exesvchost.exe

pid process

4204 90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exe
2116 svchost.exe

pid	process
4204	90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exe
2116	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exesvchost.exe

description	pid	process	target process
PID 4204 wrote to memory of 2116	4204	90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exe	svchost.exe
PID 4204 wrote to memory of 2116	4204	90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exe	svchost.exe
PID 4204 wrote to memory of 2116	4204	90ccaee873291b0b428339d3f7405a9574dc45624fd7c69bd5c6ac67ea681f97.exe	svchost.exe
PID 2116 wrote to memory of 2976	2116	svchost.exe	msedge.exe
PID 2116 wrote to memory of 2976	2116	svchost.exe	msedge.exe

memory/2116-133-0x0000000000000000-mapping.dmp

Download
memory/2116-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2976-135-0x0000000000000000-mapping.dmp

Download
memory/4204-132-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4204-134-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download