modiloader | e122f80c05c02fd7c6e6b66f19afeec412c0378e3488bbca68f889b284c952b7

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:40

Target

163305c072a676ff4da813c4f16205fc.dll
Size

126KB
MD5

163305c072a676ff4da813c4f16205fc
SHA1

ed48b5113eb056085b36929a0b03ec9cbf3ae327
SHA256

e122f80c05c02fd7c6e6b66f19afeec412c0378e3488bbca68f889b284c952b7
SHA512

8dd4e877092cbf4eff040c108f274c234b7f2cbeeca7028bc44afc3dd3696f53e1c3facba4ba455570cb39a0457900c2ce47fda8d6e7b775b57bccb7831e5f5c
SSDEEP

3072:9nEkliXBu+c7AhA64vvAWdmZn5fbfAYsTqC3rEczg7enFWP:xRl4u+cchmAW0mWC3TLwP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/2652-2-0x0000000000400000-0x0000000000484000-memory.dmp	modiloader_stage2
behavioral1/memory/2652-1-0x0000000000400000-0x0000000000484000-memory.dmp	modiloader_stage2
behavioral1/memory/2652-3-0x0000000000400000-0x0000000000484000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16
PID 2748 wrote to memory of 2652	2748	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\163305c072a676ff4da813c4f16205fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\163305c072a676ff4da813c4f16205fc.dll,#1
  2⤵
  PID:2652

memory/2652-2-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2652-1-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2652-0-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2652-3-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download