modiloader | 94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8

Analysis

max time kernel
185s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 05:53

Target

94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8.exe
Size

37KB
MD5

b8c4f314aeb7b0e6b9a8759e5596c827
SHA1

b6d1a02f672d2bfb0b00bd2c2f96db41c6b39d51
SHA256

94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8
SHA512

941e31c36ee40e7b16d91eb67a5de240f5a313b8f4b4fcdbe3132775a06ee2b5d918cc08ce8a996657d3163401c673045f7cbef540a66e2eeb0eb266612034df
SSDEEP

768:Ly1XEDewenSAj0ZGjW1EO37kRCf+qpfvsAUbvrtNrWcSXh9MXV:Ly1XYKSAoojVO37kcfDfvsAeycSxil

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3808-134-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 5076	3808	94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8.exe	82
PID 3808 wrote to memory of 5076	3808	94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8.exe	82
PID 3808 wrote to memory of 5076	3808	94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8.exe	82

C:\Users\Admin\AppData\Local\Temp\94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8.exe
"C:\Users\Admin\AppData\Local\Temp\94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Users\Admin\AppData\Local\Temp\94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8.exe
  C:\Users\Admin\AppData\Local\Temp\94f32ee1d99d9287ff338dc654c28bd927203af131c6226bacaf61633c108bd8.exe
  2⤵
  PID:5076

memory/3808-132-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3808-134-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5076-133-0x0000000000000000-mapping.dmp

Download