modiloader | e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496

Analysis

max time kernel
188s
max time network
237s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 13:51

Target

e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe
Size

315KB
MD5

0fb86ca0610e23c701bdc1407791c3c1
SHA1

c40c079e2ed24b08924235b67f3b38aa2da70b8a
SHA256

e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496
SHA512

07bf5effd2029dd63e06571b3b3ed4fd937f0cb68eb67b447465bf185cba0ba606635b9e410021fb2cc44031f4190417dcf7641d8b6cd8482e547dba412134bd
SSDEEP

6144:zxM4lCAsMetY9hJMOu42q4xCtJLCQi0eamTDjnCBhzmU:VRZsMoY9/3TtJLC7aG3Cfz

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1824-134-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral2/memory/1824-135-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral2/memory/1824-136-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1368-133-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/1824-134-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/1824-135-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral2/memory/1824-136-0x0000000000400000-0x00000000004CF000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe

description	pid	process	target process
PID 1824 set thread context of 1368	1824	e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe	mstsc.exe

Drops file in Program Files directory 1 IoCs

Processes:

e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe

description ioc process

File created C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\2010.txt e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe

description	ioc	process
File created	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\2010.txt	e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe

description	pid	process	target process
PID 1824 wrote to memory of 1368	1824	e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe	mstsc.exe
PID 1824 wrote to memory of 1368	1824	e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe	mstsc.exe
PID 1824 wrote to memory of 1368	1824	e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe	mstsc.exe
PID 1824 wrote to memory of 1368	1824	e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe	mstsc.exe
PID 1824 wrote to memory of 1368	1824	e9cf48b3a27544dd170e31a7edd98021032e76514d08715e7bc4aaf20ae17496.exe	mstsc.exe

memory/1368-132-0x0000000000000000-mapping.dmp

Download
memory/1368-133-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1824-134-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1824-135-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1824-136-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download