modiloader | a0a12f066843aaffc3b2a5526f50c2b30ebf67bc20a5d82c54ebb20dfe5f6767

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 18:16

Target

a0a12f066843aaffc3b2a5526f50c2b30ebf67bc20a5d82c54ebb20dfe5f6767.exe
Size

76KB
MD5

159c1d7d997cbf98d0cc4895ff095e99
SHA1

d2d8767738a13f45500428869b091b1c0c64afdd
SHA256

a0a12f066843aaffc3b2a5526f50c2b30ebf67bc20a5d82c54ebb20dfe5f6767
SHA512

650f0d5d8966103c303c48cc094d8cbeb48db289797efe25ebdf2c8f034c85e47bd7ecfe013d9550449e617985b45d9d915c24a20637b85b8bd58805ed48fecf
SSDEEP

1536:8kU7JbZfzAg07EDhmvJMH7rl7jA0U6LNg6s1UzQe+Q/0WJV9:8kU7J9fzsghKK7a0/LmD1QjzH

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4800-132-0x0000000030000000-0x0000000030034000-memory.dmp	modiloader_stage2

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4480	4800	WerFault.exe	80
4132	4800	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4480	4800	a0a12f066843aaffc3b2a5526f50c2b30ebf67bc20a5d82c54ebb20dfe5f6767.exe	82
PID 4800 wrote to memory of 4480	4800	a0a12f066843aaffc3b2a5526f50c2b30ebf67bc20a5d82c54ebb20dfe5f6767.exe	82
PID 4800 wrote to memory of 4480	4800	a0a12f066843aaffc3b2a5526f50c2b30ebf67bc20a5d82c54ebb20dfe5f6767.exe	82

C:\Users\Admin\AppData\Local\Temp\a0a12f066843aaffc3b2a5526f50c2b30ebf67bc20a5d82c54ebb20dfe5f6767.exe
"C:\Users\Admin\AppData\Local\Temp\a0a12f066843aaffc3b2a5526f50c2b30ebf67bc20a5d82c54ebb20dfe5f6767.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 516
  2⤵
  - Program crash
  PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 516
  2⤵
  - Program crash
  PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4800 -ip 4800
1⤵
PID:2064

memory/4800-132-0x0000000030000000-0x0000000030034000-memory.dmp

Filesize
208KB

Download