modiloader | 5245aa7331cea82b59c5c80621d1facef974e6e684ce3fa9607c5e1f57664c5e

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:32

Target

1e8abb285b46667102c421326fce816f.exe
Size

406KB
MD5

1e8abb285b46667102c421326fce816f
SHA1

3b8935b51efb6dd5673d790a00456aa1fea1a6c5
SHA256

5245aa7331cea82b59c5c80621d1facef974e6e684ce3fa9607c5e1f57664c5e
SHA512

67e9cba951397fcd622088f7e4ca1b583ab7a4c3c202f761904d2f062fd5cc2e6d2ef0aaaeefb39a7f822263956739de4a05f9a8a096e58083dd65eb8a0c5390
SSDEEP

6144:G++2HZCnhAfxr4wZ5Bb0XVHtJBMKwrHWIa5esd6DSyVNW09oGL0:x+eZC095BoFx0KdV0NW0+l

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/1236-2-0x0000000000400000-0x0000000000534000-memory.dmp	modiloader_stage2
behavioral1/memory/1236-1-0x0000000000400000-0x0000000000534000-memory.dmp	modiloader_stage2
behavioral1/memory/1236-5-0x0000000000400000-0x0000000000534000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	1e8abb285b46667102c421326fce816f.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1688	1236	WerFault.exe	23

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2404	1236	1e8abb285b46667102c421326fce816f.exe	28
PID 1236 wrote to memory of 2404	1236	1e8abb285b46667102c421326fce816f.exe	28
PID 1236 wrote to memory of 2404	1236	1e8abb285b46667102c421326fce816f.exe	28
PID 1236 wrote to memory of 2404	1236	1e8abb285b46667102c421326fce816f.exe	28
PID 1236 wrote to memory of 1688	1236	1e8abb285b46667102c421326fce816f.exe	29
PID 1236 wrote to memory of 1688	1236	1e8abb285b46667102c421326fce816f.exe	29
PID 1236 wrote to memory of 1688	1236	1e8abb285b46667102c421326fce816f.exe	29
PID 1236 wrote to memory of 1688	1236	1e8abb285b46667102c421326fce816f.exe	29

C:\Users\Admin\AppData\Local\Temp\1e8abb285b46667102c421326fce816f.exe
"C:\Users\Admin\AppData\Local\Temp\1e8abb285b46667102c421326fce816f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1236
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 296
  2⤵
  - Program crash
  PID:1688

memory/1236-0-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/1236-2-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/1236-1-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/1236-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1236-5-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/1236-6-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download