modiloader | 5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693

Analysis

max time kernel
44s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
22/12/2022, 14:15

Target

5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693.dll
Size

141KB
MD5

ee94f46ed9b387ad243c36c1cb062686
SHA1

6e0c4dc795dec2dce9454fbb246afabffd2039fc
SHA256

5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693
SHA512

63eaa037e82775efbe7af57af82613b6b01acc56a12085467f6eb32b7e71dfcbe6791300618f6f0f3203f0d2dd5a924ae3b742a478d5fd7e6917e92d1a47d7e2
SSDEEP

3072:1P5WCVyQQdnzs14CSJBXrHdKENrcIHEI9wG:1P5WgQNLCGT5ccEC

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/844-56-0x0000000000121000-0x000000000013F000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693.dll,#1
  2⤵
  PID:844

memory/844-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/844-56-0x0000000000121000-0x000000000013F000-memory.dmp

Filesize
120KB

Download