modiloader | d00a9f9d2ace22e18f110b18b5bca3a4c9a5f62918dde72c86e0164e1f04fa1a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:11

Target

11d2cdee4b765b57ef9cb198e9590b68.dll
Size

24KB
MD5

11d2cdee4b765b57ef9cb198e9590b68
SHA1

9add3ea4619d3181a0887e1aa038152e4ed28bb3
SHA256

d00a9f9d2ace22e18f110b18b5bca3a4c9a5f62918dde72c86e0164e1f04fa1a
SHA512

b7df853298efae7865315b74774f9e2f52e7bc53654598d1448c9b6e87d3fe63a425705b6ba54f627135c57fc5f57d3e48bd0b9c0eec23d01187cd221964b958
SSDEEP

384:1AA9Z2vDp2MQDYRFncDoyYW4P0Zl452qjd75xmZYerJTETerDgfsAezl8gp:1H9Z20DYRFcDoyksY78rJawbp

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1476-1-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1476	1560	regsvr32.exe	88
PID 1560 wrote to memory of 1476	1560	regsvr32.exe	88
PID 1560 wrote to memory of 1476	1560	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\11d2cdee4b765b57ef9cb198e9590b68.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\11d2cdee4b765b57ef9cb198e9590b68.dll
  2⤵
  PID:1476

memory/1476-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1476-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1476-2-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download