modiloader | e122f80c05c02fd7c6e6b66f19afeec412c0378e3488bbca68f889b284c952b7

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 10:40

Target

163305c072a676ff4da813c4f16205fc.dll
Size

126KB
MD5

163305c072a676ff4da813c4f16205fc
SHA1

ed48b5113eb056085b36929a0b03ec9cbf3ae327
SHA256

e122f80c05c02fd7c6e6b66f19afeec412c0378e3488bbca68f889b284c952b7
SHA512

8dd4e877092cbf4eff040c108f274c234b7f2cbeeca7028bc44afc3dd3696f53e1c3facba4ba455570cb39a0457900c2ce47fda8d6e7b775b57bccb7831e5f5c
SSDEEP

3072:9nEkliXBu+c7AhA64vvAWdmZn5fbfAYsTqC3rEczg7enFWP:xRl4u+cchmAW0mWC3TLwP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/3724-1-0x00000000020C0000-0x0000000002144000-memory.dmp	modiloader_stage2
behavioral2/memory/3724-0-0x00000000020C0000-0x0000000002144000-memory.dmp	modiloader_stage2
behavioral2/memory/3724-2-0x00000000020C0000-0x0000000002144000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3724	8	rundll32.exe	12
PID 8 wrote to memory of 3724	8	rundll32.exe	12
PID 8 wrote to memory of 3724	8	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\163305c072a676ff4da813c4f16205fc.dll,#1
1⤵
PID:3724

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\163305c072a676ff4da813c4f16205fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8

memory/3724-1-0x00000000020C0000-0x0000000002144000-memory.dmp

Filesize
528KB

Download
memory/3724-0-0x00000000020C0000-0x0000000002144000-memory.dmp

Filesize
528KB

Download
memory/3724-2-0x00000000020C0000-0x0000000002144000-memory.dmp

Filesize
528KB

Download