modiloader | d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa

Analysis

max time kernel
232s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 12:34

Target

d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa.exe
Size

688KB
MD5

1335a2a782355152afbd5ee22850a020
SHA1

f7fbd52a36cbf19cab08c9b1479fcbded373f505
SHA256

d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa
SHA512

31f8580c7107ac4a7d8ef6c1a4e8f3d5294fcf5dab686846b5760d43fb24b28a12368d573a197b9dfcd021b68752e55d5a9fd317f2cb7a86d435b26d9d83787b
SSDEEP

12288:cw8INEKT8XOqLNbx+jZ9FH1nnrPuyoh9gmJVIYiTY8:ZnNE9+qL7eHH1ivEmJuYiT9

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/516-54-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2
behavioral1/memory/516-56-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

Processes:

d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt	d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa.exe

description	pid	process	target process
PID 516 wrote to memory of 1184	516	d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa.exe	IEXPLORE.EXE
PID 516 wrote to memory of 1184	516	d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa.exe	IEXPLORE.EXE
PID 516 wrote to memory of 1184	516	d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa.exe	IEXPLORE.EXE
PID 516 wrote to memory of 1184	516	d114d95b698d3a45495e7642dc05fd1c46957ca6250a64059a4aa2e0967a06fa.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:1184

memory/516-54-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/516-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/516-56-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download