modiloader | b79b20c44857f5d00ebc2e4be8226a7f23460a25eaad85023127af6a09c48980

Resubmissions

03-01-2023 10:26

30-12-2022 15:20

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2022 15:20

Target

e680554fa3ec812160ea4fe8bbcafeac.exe
Size

5.2MB
MD5

e680554fa3ec812160ea4fe8bbcafeac
SHA1

d5b2d9f227a419d60af8c93fd890e1858682055f
SHA256

b79b20c44857f5d00ebc2e4be8226a7f23460a25eaad85023127af6a09c48980
SHA512

680559a7d3eab6a45a76d87e3ed393b7247b43a2556786c4bd180b61104cf337da58d8206f0111a916e0df12554eaada5aa99a3b9abc6a59574591785f59a340
SSDEEP

98304:TdVwc5vJ8o/UUhsAn32ennaMjUckirsnS/PpJhanPiO+XtkF9xBf7m1709ooMDP:xVVvJxFjnmeaMjUckiYcBCnPiOemF9xG

Score

10^/10

Family

systembc

oversizetights.com:4246

myprettysocks.com:4246

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1368-135-0x0000000010000000-0x00000000110D9000-memory.dmp	modiloader_stage2
behavioral2/memory/1368-141-0x0000000010000000-0x00000000110D9000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

Processes:

e680554fa3ec812160ea4fe8bbcafeac.exe

description pid process target process

PID 1368 set thread context of 4988 1368 e680554fa3ec812160ea4fe8bbcafeac.exe e680554fa3ec812160ea4fe8bbcafeac.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e680554fa3ec812160ea4fe8bbcafeac.exe

pid process

1368 e680554fa3ec812160ea4fe8bbcafeac.exe
1368 e680554fa3ec812160ea4fe8bbcafeac.exe

description	pid	process	target process
PID 1368 set thread context of 4988	1368	e680554fa3ec812160ea4fe8bbcafeac.exe	e680554fa3ec812160ea4fe8bbcafeac.exe

pid	process
1368	e680554fa3ec812160ea4fe8bbcafeac.exe
1368	e680554fa3ec812160ea4fe8bbcafeac.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e680554fa3ec812160ea4fe8bbcafeac.exe

description	pid	process	target process
PID 1368 wrote to memory of 4988	1368	e680554fa3ec812160ea4fe8bbcafeac.exe	e680554fa3ec812160ea4fe8bbcafeac.exe
PID 1368 wrote to memory of 4988	1368	e680554fa3ec812160ea4fe8bbcafeac.exe	e680554fa3ec812160ea4fe8bbcafeac.exe
PID 1368 wrote to memory of 4988	1368	e680554fa3ec812160ea4fe8bbcafeac.exe	e680554fa3ec812160ea4fe8bbcafeac.exe
PID 1368 wrote to memory of 4988	1368	e680554fa3ec812160ea4fe8bbcafeac.exe	e680554fa3ec812160ea4fe8bbcafeac.exe
PID 1368 wrote to memory of 4988	1368	e680554fa3ec812160ea4fe8bbcafeac.exe	e680554fa3ec812160ea4fe8bbcafeac.exe

C:\Users\Admin\AppData\Local\Temp\e680554fa3ec812160ea4fe8bbcafeac.exe
C:\Users\Admin\AppData\Local\Temp\e680554fa3ec812160ea4fe8bbcafeac.exe
2⤵
PID:4988

memory/1368-132-0x0000000010000000-0x00000000110D9000-memory.dmp

Filesize
16.8MB

Download
memory/1368-133-0x0000000010000000-0x00000000110D9000-memory.dmp

Filesize
16.8MB

Download
memory/1368-134-0x0000000010000000-0x00000000110D9000-memory.dmp

Filesize
16.8MB

Download
memory/1368-135-0x0000000010000000-0x00000000110D9000-memory.dmp

Filesize
16.8MB

Download
memory/1368-141-0x0000000010000000-0x00000000110D9000-memory.dmp

Filesize
16.8MB

Download
memory/4988-137-0x0000000000000000-mapping.dmp

Download
memory/4988-138-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4988-140-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4988-142-0x0000000010000000-0x00000000110D9000-memory.dmp

Filesize
16.8MB

Download