modiloader | d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89

Analysis

max time kernel
7s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 12:32

Target

d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe
Size

111KB
MD5

51882ee01db9282a25820b10c5618dea
SHA1

6f5a36a49650576e03bd03efcc849574e05bb06b
SHA256

d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89
SHA512

c5ab9e106b729fbda6351ee45e1d4168efb379c93351fd7cdfc953688c4f9a9aaf90d9dc69bfa55ba65b2675e1d4cb279cd079979709ce41003ff1455c4b11d3
SSDEEP

3072:91+MJKrUnFYY5z1i0Nmbi5f/BNPhkout:LIrPj0NmWTNyoS

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1216-56-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1216-56-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

968 1216 WerFault.exe d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe

pid	pid_target	process	target process
968	1216	WerFault.exe	d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe

description	pid	process	target process
PID 1216 wrote to memory of 968	1216	d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe	WerFault.exe
PID 1216 wrote to memory of 968	1216	d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe	WerFault.exe
PID 1216 wrote to memory of 968	1216	d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe	WerFault.exe
PID 1216 wrote to memory of 968	1216	d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe
"C:\Users\Admin\AppData\Local\Temp\d1a88cad9d3d1cd8d6efd63340f5745ea8e4803496d8993a912703e23c0ede89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 204
2⤵
- Program crash
PID:968

memory/968-55-0x0000000000000000-mapping.dmp

Download
memory/1216-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1216-56-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download