modiloader | cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 02:35

Target

cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8.exe
Size

425KB
MD5

853c7108430a18a545321b50d031693a
SHA1

ce47af8085ed01225dee00250f2b53e37a0e1d72
SHA256

cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8
SHA512

436d94884d277358fc5337f2f01316eb0dcc50ea0bbbe39af55a7e1fea21fb7cf1100981e415fb762f3b0f95be3729eb1293f181cf6e1e677026f18fe132502e
SSDEEP

6144:mAx5vk7gUmlctuM0x7+yV6BXtlmOzy7U2IS8b6JC97/rizw4Me8++NmAHHF7N1:mMDUmlctul7hUIOzPDbp92sMwmklh1

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1468-56-0x0000000000400000-0x000000000052E26A-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SetupWay.txt	cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1748	1468	cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8.exe	27
PID 1468 wrote to memory of 1748	1468	cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8.exe	27
PID 1468 wrote to memory of 1748	1468	cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8.exe	27
PID 1468 wrote to memory of 1748	1468	cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8.exe	27

C:\Users\Admin\AppData\Local\Temp\cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8.exe
"C:\Users\Admin\AppData\Local\Temp\cf1ea6ecf83964696c5ccb2def312cb81f2140fa841e9775d56a6ea247a158d8.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1468
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:1748

memory/1468-54-0x0000000000400000-0x000000000052E26A-memory.dmp

Filesize
1.2MB

Download
memory/1468-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1468-56-0x0000000000400000-0x000000000052E26A-memory.dmp

Filesize
1.2MB

Download