modiloader | c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:11

Target

c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476.exe
Size

1.8MB
MD5

7ed7cbd221be0046fbd5f71be466a36f
SHA1

99fcf98bbf22f677ab469185549551170459b2eb
SHA256

c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476
SHA512

3e7b073db628123755f0c29e8581b2e892daf7c26333ddb030a61a812b7fe36b57943b335dbf7000f2b0a0281c1f3ad6247139403acaeb7e59f8e9f8b2108cd5
SSDEEP

49152:YnQQojNoeAfcpP7Hgw/5bbvCxGWpActpcf:tQoj1pP7HD5XvHWpAff

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2024-56-0x0000000000400000-0x00000000007A9000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2024	c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1640	2024	c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476.exe	26
PID 2024 wrote to memory of 1640	2024	c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476.exe	26
PID 2024 wrote to memory of 1640	2024	c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476.exe	26
PID 2024 wrote to memory of 1640	2024	c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476.exe	26

C:\Users\Admin\AppData\Local\Temp\c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476.exe
"C:\Users\Admin\AppData\Local\Temp\c7b08a417a07564a5703fa9a37409296676fd13e2e6761a6e874393e447cd476.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:1640

memory/2024-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/2024-55-0x0000000002120000-0x0000000002217000-memory.dmp

Filesize
988KB

Download
memory/2024-56-0x0000000000400000-0x00000000007A9000-memory.dmp

Filesize
3.7MB

Download