modiloader | 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2

Analysis

max time kernel
142s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 15:51

Target

6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe
Size

1.1MB
MD5

22d3a3c2ef2230695bc95068c085439d
SHA1

a07bc44e9b4d2321db79e742c0ee94c22f0379df
SHA256

6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2
SHA512

092d839ae5a70b3930185ba4df76d737ec73a4d2978d5f09287dd893af336f321134d28f81be6dcb28392a054126808b78600bb6f10d4e576fec11f384bd3688
SSDEEP

12288:qE8C9kdWdEPv8zuVEdh9a6OLqvabdpmBkt1VEmA00P85Be2fgmv1qsM8HcZG3g5I:qEPudPPOuVsaoAjlD0P83H5M8OG3

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1496-1-0x0000000002E00000-0x0000000003E00000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process
PID 1496 wrote to memory of 0	1496	6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe

C:\Users\Admin\AppData\Local\Temp\6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

memory/1496-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1496-1-0x0000000002E00000-0x0000000003E00000-memory.dmp

Filesize
16.0MB

Download
memory/1496-3-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/1496-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download