modiloader | ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 12:27

Target

ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5.exe
Size

361KB
MD5

41b3f8e20552afa06dc0f18692b0de92
SHA1

0f769fbd42880f7701a018d825f5ed556bb2545c
SHA256

ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5
SHA512

cef0d35e9a436eb782770263f7425ad27e58bd26962943f45a587d5c5ed305f76fafd51706048c46998d848baad0f26e8b2ed4301f395905faabb23a3cd36cd0
SSDEEP

6144:0ARUkwADMTihkdA0Z6fQQ+tAHEMqbTmkWKksTcTrELWnjBTgXUX6jRk3gII/w:WoM2iNuveAkzmkWZyc3E6peUKjQdI/w

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1628-55-0x0000000000400000-0x00000000004C7000-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SetupWay.txt	ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 916	1628	ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5.exe	28
PID 1628 wrote to memory of 916	1628	ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5.exe	28
PID 1628 wrote to memory of 916	1628	ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5.exe	28
PID 1628 wrote to memory of 916	1628	ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5.exe	28

C:\Users\Admin\AppData\Local\Temp\ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5.exe
"C:\Users\Admin\AppData\Local\Temp\ecbfb31e12eac6eaa6a0046936a1087ddf7910710b38ebb87a3b8378b1f9e5a5.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1628
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:916

memory/1628-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1628-55-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download