modiloader | b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 07:50

Target

b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe
Size

713KB
MD5

2e5e6c15e8c45c71726de046d4ea74a8
SHA1

1ec1a3c73399d64cadc7a9c0f233ed8cdc26a762
SHA256

b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d
SHA512

ff7bc9af81bcc623aa8cdc3ed7c4029bc32ed3eca0969764971285b8dbb533ae2acb8f3d3588f29742d2dcbe6ef186e9bfab77afd2d2d4c13f48d783f0602d34
SSDEEP

12288:nGMz5TT+i9DRLo4jepFQHtew1g9FnwwTYBLLUGYdQgo+TOPxEoRaKm:GI5n9DuHDAU9FnwR9I5o+TOSooKm

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2032-58-0x000000000049996C-mapping.dmp	modiloader_stage2
behavioral1/memory/2032-57-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 2032	1488	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	26

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2032	1488	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	26
PID 1488 wrote to memory of 2032	1488	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	26
PID 1488 wrote to memory of 2032	1488	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	26
PID 1488 wrote to memory of 2032	1488	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	26
PID 1488 wrote to memory of 2032	1488	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	26
PID 1488 wrote to memory of 2032	1488	b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe	26

C:\Users\Admin\AppData\Local\Temp\b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe
"C:\Users\Admin\AppData\Local\Temp\b94bb7e34abf1daf33b8bc20a259a56f2ee21616a62367267928dcdc36287f3d.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\system32\mstsc.exe"
  2⤵
  PID:2032

memory/1488-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2032-57-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download