modiloader | 847c8825d8a307b27cdf6853853243f6662e1c7af7c0d00deaaa5e097713b82a

Analysis

max time kernel
123s
max time network
31s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:13

Target

2b5bbe50b1e1d57d247a85828e412e82.exe
Size

686KB
MD5

2b5bbe50b1e1d57d247a85828e412e82
SHA1

4cb41def0d5432b3b09d52b5b558b961267f7f35
SHA256

847c8825d8a307b27cdf6853853243f6662e1c7af7c0d00deaaa5e097713b82a
SHA512

eb3b46667313e80d044beffe6c1182e760de602f11657299aadc13b3b32d2a027d5972a46df2c739885e49ac1fc803bd24c21344c1362705ec36bf998fbcdcce
SSDEEP

12288:La/9WALVFsstkPKz+PrNVZFnVMLLLTF3Z4mxxODqVTVOCy:2AussIE+Prh7MLLvQmXdVTzy

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2580-11-0x0000000000400000-0x000000000056C000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	2b5bbe50b1e1d57d247a85828e412e82.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	2580	WerFault.exe	13

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1916	2580	2b5bbe50b1e1d57d247a85828e412e82.exe	28
PID 2580 wrote to memory of 1916	2580	2b5bbe50b1e1d57d247a85828e412e82.exe	28
PID 2580 wrote to memory of 1916	2580	2b5bbe50b1e1d57d247a85828e412e82.exe	28
PID 2580 wrote to memory of 1916	2580	2b5bbe50b1e1d57d247a85828e412e82.exe	28
PID 2580 wrote to memory of 1460	2580	2b5bbe50b1e1d57d247a85828e412e82.exe	29
PID 2580 wrote to memory of 1460	2580	2b5bbe50b1e1d57d247a85828e412e82.exe	29
PID 2580 wrote to memory of 1460	2580	2b5bbe50b1e1d57d247a85828e412e82.exe	29
PID 2580 wrote to memory of 1460	2580	2b5bbe50b1e1d57d247a85828e412e82.exe	29

C:\Users\Admin\AppData\Local\Temp\2b5bbe50b1e1d57d247a85828e412e82.exe
"C:\Users\Admin\AppData\Local\Temp\2b5bbe50b1e1d57d247a85828e412e82.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2580
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 316
  2⤵
  - Program crash
  PID:1460

memory/2580-0-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/2580-1-0x0000000000640000-0x0000000000694000-memory.dmp

Filesize
336KB

Download
memory/2580-8-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2580-10-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2580-9-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2580-7-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2580-6-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2580-5-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2580-4-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2580-3-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2580-2-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2580-11-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/2580-13-0x0000000000640000-0x0000000000694000-memory.dmp

Filesize
336KB

Download
memory/2580-15-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/2580-17-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download