modiloader | d118deba30379041074abca2dca83f00e02940ef1309a6a8153c9e68c4cf40ef

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:55

Target

1f1d348153db601b03af017745a5a0a1.exe
Size

290KB
MD5

1f1d348153db601b03af017745a5a0a1
SHA1

dc80dfd810ff88b3acb011f6cb4b7a269441beb5
SHA256

d118deba30379041074abca2dca83f00e02940ef1309a6a8153c9e68c4cf40ef
SHA512

690b610245bfd0d5415c670b0813c04ea819054e52711a1beba440f7cb600c763f717e745920406e4fa784e3562f7411d1661a4cf04995623eb82fc487fd6dc5
SSDEEP

6144:n0J+kIyh66vNZoHhzWES2GBTrn2BNs/FjSocEC5qbcHyhQcrEzRLa:0JBIeNIWQG5n2BNAj2Z5qbuSQcA1a

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/1144-13-0x0000000000400000-0x000000000054A000-memory.dmp	modiloader_stage2
behavioral1/memory/768-21-0x0000000000400000-0x000000000054A000-memory.dmp	modiloader_stage2
behavioral1/memory/1144-23-0x0000000000400000-0x000000000054A000-memory.dmp	modiloader_stage2
behavioral1/memory/768-31-0x0000000000400000-0x000000000054A000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
3016	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1144	360Safe.exe

Loads dropped DLL 7 IoCs

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe	1f1d348153db601b03af017745a5a0a1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe	1f1d348153db601b03af017745a5a0a1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat	1f1d348153db601b03af017745a5a0a1.exe

Program crash 1 IoCs

pid	pid_target	Process
2856	1144	WerFault.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 1144	768	1f1d348153db601b03af017745a5a0a1.exe	29
PID 768 wrote to memory of 1144	768	1f1d348153db601b03af017745a5a0a1.exe	29
PID 768 wrote to memory of 1144	768	1f1d348153db601b03af017745a5a0a1.exe	29
PID 768 wrote to memory of 1144	768	1f1d348153db601b03af017745a5a0a1.exe	29
PID 1144 wrote to memory of 2856	1144	360Safe.exe	28
PID 1144 wrote to memory of 2856	1144	360Safe.exe	28
PID 1144 wrote to memory of 2856	1144	360Safe.exe	28
PID 1144 wrote to memory of 2856	1144	360Safe.exe	28
PID 768 wrote to memory of 3016	768	1f1d348153db601b03af017745a5a0a1.exe	32
PID 768 wrote to memory of 3016	768	1f1d348153db601b03af017745a5a0a1.exe	32
PID 768 wrote to memory of 3016	768	1f1d348153db601b03af017745a5a0a1.exe	32
PID 768 wrote to memory of 3016	768	1f1d348153db601b03af017745a5a0a1.exe	32

C:\Users\Admin\AppData\Local\Temp\1f1d348153db601b03af017745a5a0a1.exe
"C:\Users\Admin\AppData\Local\Temp\1f1d348153db601b03af017745a5a0a1.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat""
  2⤵
  - Deletes itself
  PID:3016

memory/768-0-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/768-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/768-2-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/768-15-0x0000000002C10000-0x0000000002D5A000-memory.dmp

Filesize
1.3MB

Download
memory/768-11-0x0000000002C10000-0x0000000002D5A000-memory.dmp

Filesize
1.3MB

Download
memory/768-22-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/768-21-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/768-31-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1144-14-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1144-13-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1144-23-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download