modiloader | 2280da65fc3a2202281d7807ef24b90a3e9dc153fc09715bf96fd4046abc0b60

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:39

Target

231837fdb4bf0ecbb15fc0a090460095.dll
Size

18KB
MD5

231837fdb4bf0ecbb15fc0a090460095
SHA1

6ecf2bf4796d69fa3881c957989322bafc3ea2d4
SHA256

2280da65fc3a2202281d7807ef24b90a3e9dc153fc09715bf96fd4046abc0b60
SHA512

f46b277330a3642b0426cbdd7185b53821a3a074819a8632dcc93bcbd404a4e50007ea16e2634686dfe83c36f01f7695d662d2d99f57c6a9d8df2d97030f8812
SSDEEP

384:VvGdTEu2qc0lpLsz0/Cs0OqSHyf0mfIekcNKCt+zT3X:Vhu2qdlpLsz9jpSHyvIekGtuT

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2832-0-0x0000000000140000-0x000000000014B000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	2832	WerFault.exe	18

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2832	2652	rundll32.exe	18
PID 2652 wrote to memory of 2832	2652	rundll32.exe	18
PID 2652 wrote to memory of 2832	2652	rundll32.exe	18
PID 2652 wrote to memory of 2832	2652	rundll32.exe	18
PID 2652 wrote to memory of 2832	2652	rundll32.exe	18
PID 2652 wrote to memory of 2832	2652	rundll32.exe	18
PID 2652 wrote to memory of 2832	2652	rundll32.exe	18
PID 2832 wrote to memory of 2788	2832	rundll32.exe	20
PID 2832 wrote to memory of 2788	2832	rundll32.exe	20
PID 2832 wrote to memory of 2788	2832	rundll32.exe	20
PID 2832 wrote to memory of 2788	2832	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\231837fdb4bf0ecbb15fc0a090460095.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\231837fdb4bf0ecbb15fc0a090460095.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 228
    3⤵
    - Program crash
    PID:2788

memory/2832-0-0x0000000000140000-0x000000000014B000-memory.dmp

Filesize
44KB

Download