modiloader | 0073016c14f29718723672849e377dc0dc96405ac388a8ada40b2bcc6d0599eb

Analysis

max time kernel
118s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:19

Target

05747d4b8019f2fa23c003fd90229342.exe
Size

89KB
MD5

05747d4b8019f2fa23c003fd90229342
SHA1

ef8e29f02e6adbba6886280d3861acd05142fcb0
SHA256

0073016c14f29718723672849e377dc0dc96405ac388a8ada40b2bcc6d0599eb
SHA512

5342c7c3f9d6fb78a05cb8b22ed59dc3382efb4796ea14c61677f2a92cff30b0400bf069feb690cf61edef3203c6b3bc91462e88e6cf9022ae28a588b9b37e86
SSDEEP

1536:SnpiCy//4x02Pbc6TecPTHghptOc7byh70mg9LrrXONeadGpH0LTiEN:gg4xlwwbHmyc7o9g9LrLL6kK9N

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1516-7-0x0000000010000000-0x0000000010018000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 2976	1516	05747d4b8019f2fa23c003fd90229342.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2976	05747d4b8019f2fa23c003fd90229342.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2976	1516	05747d4b8019f2fa23c003fd90229342.exe	28
PID 1516 wrote to memory of 2976	1516	05747d4b8019f2fa23c003fd90229342.exe	28
PID 1516 wrote to memory of 2976	1516	05747d4b8019f2fa23c003fd90229342.exe	28
PID 1516 wrote to memory of 2976	1516	05747d4b8019f2fa23c003fd90229342.exe	28
PID 1516 wrote to memory of 2976	1516	05747d4b8019f2fa23c003fd90229342.exe	28
PID 1516 wrote to memory of 2976	1516	05747d4b8019f2fa23c003fd90229342.exe	28
PID 2976 wrote to memory of 1368	2976	05747d4b8019f2fa23c003fd90229342.exe	22
PID 2976 wrote to memory of 1368	2976	05747d4b8019f2fa23c003fd90229342.exe	22
PID 2976 wrote to memory of 1368	2976	05747d4b8019f2fa23c003fd90229342.exe	22
PID 2976 wrote to memory of 1368	2976	05747d4b8019f2fa23c003fd90229342.exe	22
PID 2976 wrote to memory of 1368	2976	05747d4b8019f2fa23c003fd90229342.exe	22
PID 2976 wrote to memory of 1368	2976	05747d4b8019f2fa23c003fd90229342.exe	22

memory/1368-13-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1368-19-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1516-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1516-1-0x00000000001B0000-0x00000000001C8000-memory.dmp

Filesize
96KB

Download
memory/1516-7-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2976-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2976-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2976-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2976-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2976-10-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2976-12-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2976-31-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download