modiloader | 1626714618c65423a338d433d8080980eb23ebeaa7aa07948584d2daa062171e

Analysis

max time kernel
16s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d2710b718ed77053cbddfd72cc731d2.exe
Size

387KB
MD5

2d2710b718ed77053cbddfd72cc731d2
SHA1

e9d19d2eef6f614452f7162af9c4d0664b18f388
SHA256

1626714618c65423a338d433d8080980eb23ebeaa7aa07948584d2daa062171e
SHA512

bcb2486024cb198d4aba2a9a738fb8bc51e078a1fc16529ca57fb59369c6e9ce496a3eff742c422ee586192d1758aa796c64cbded61b9cfe271857cee8afeb09
SSDEEP

12288:AoOtmpbfZIHlN8gaDM1g14adnJsu6BSCKOsGDkQF9ajaEno:ctmpbBIuMm14fSCIeFWtno

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral2/memory/784-8-0x0000000010000000-0x0000000010417000-memory.dmp	modiloader_stage2
behavioral2/memory/1724-22-0x0000000010000000-0x0000000010417000-memory.dmp	modiloader_stage2
behavioral2/memory/2848-21-0x0000000010000000-0x0000000010417000-memory.dmp	modiloader_stage2
behavioral2/memory/2536-121-0x0000000010000000-0x0000000010417000-memory.dmp	modiloader_stage2

Executes dropped EXE 4 IoCs

pid	Process
2848	csmm.exe
1724	csmm.exe
4384	csmm.exe
3300	csmm.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\csmm.exe	2d2710b718ed77053cbddfd72cc731d2.exe
File opened for modification	C:\Windows\SysWOW64\csmm.exe	2d2710b718ed77053cbddfd72cc731d2.exe
File opened for modification	C:\Windows\SysWOW64\csmm.exe	csmm.exe
File created	C:\Windows\SysWOW64\csmm.exe	csmm.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 784 set thread context of 544	784	2d2710b718ed77053cbddfd72cc731d2.exe	20
PID 2848 set thread context of 1724	2848	csmm.exe	17
PID 4384 set thread context of 3300	4384	csmm.exe	113

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 544	784	2d2710b718ed77053cbddfd72cc731d2.exe	20
PID 784 wrote to memory of 544	784	2d2710b718ed77053cbddfd72cc731d2.exe	20
PID 784 wrote to memory of 544	784	2d2710b718ed77053cbddfd72cc731d2.exe	20
PID 784 wrote to memory of 544	784	2d2710b718ed77053cbddfd72cc731d2.exe	20
PID 784 wrote to memory of 544	784	2d2710b718ed77053cbddfd72cc731d2.exe	20
PID 544 wrote to memory of 2848	544	2d2710b718ed77053cbddfd72cc731d2.exe	19
PID 544 wrote to memory of 2848	544	2d2710b718ed77053cbddfd72cc731d2.exe	19
PID 544 wrote to memory of 2848	544	2d2710b718ed77053cbddfd72cc731d2.exe	19
PID 2848 wrote to memory of 1724	2848	csmm.exe	17
PID 2848 wrote to memory of 1724	2848	csmm.exe	17
PID 2848 wrote to memory of 1724	2848	csmm.exe	17
PID 2848 wrote to memory of 1724	2848	csmm.exe	17
PID 2848 wrote to memory of 1724	2848	csmm.exe	17
PID 1724 wrote to memory of 4384	1724	csmm.exe	104
PID 1724 wrote to memory of 4384	1724	csmm.exe	104
PID 1724 wrote to memory of 4384	1724	csmm.exe	104
PID 4384 wrote to memory of 3300	4384	csmm.exe	113
PID 4384 wrote to memory of 3300	4384	csmm.exe	113
PID 4384 wrote to memory of 3300	4384	csmm.exe	113
PID 4384 wrote to memory of 3300	4384	csmm.exe	113
PID 4384 wrote to memory of 3300	4384	csmm.exe	113

C:\Users\Admin\AppData\Local\Temp\2d2710b718ed77053cbddfd72cc731d2.exe
"C:\Users\Admin\AppData\Local\Temp\2d2710b718ed77053cbddfd72cc731d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\2d2710b718ed77053cbddfd72cc731d2.exe
  C:\Users\Admin\AppData\Local\Temp\2d2710b718ed77053cbddfd72cc731d2.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:544

C:\Windows\SysWOW64\csmm.exe
C:\Windows\SysWOW64\csmm.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\csmm.exe
  C:\Windows\system32\csmm.exe 1148 "C:\Windows\SysWOW64\csmm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4384

C:\Windows\SysWOW64\csmm.exe
C:\Windows\system32\csmm.exe 1120 "C:\Users\Admin\AppData\Local\Temp\2d2710b718ed77053cbddfd72cc731d2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\SysWOW64\csmm.exe
C:\Windows\SysWOW64\csmm.exe
1⤵
PID:3300
- C:\Windows\SysWOW64\csmm.exe
  C:\Windows\system32\csmm.exe 1124 "C:\Windows\SysWOW64\csmm.exe"
  2⤵
  PID:4952

C:\Windows\SysWOW64\csmm.exe
C:\Windows\SysWOW64\csmm.exe
1⤵
PID:1864
- C:\Windows\SysWOW64\csmm.exe
  C:\Windows\system32\csmm.exe 1120 "C:\Windows\SysWOW64\csmm.exe"
  2⤵
  PID:4452

C:\Windows\SysWOW64\csmm.exe
C:\Windows\SysWOW64\csmm.exe
1⤵
PID:2752
- C:\Windows\SysWOW64\csmm.exe
  C:\Windows\system32\csmm.exe 1120 "C:\Windows\SysWOW64\csmm.exe"
  2⤵
  PID:3180

C:\Windows\SysWOW64\csmm.exe
C:\Windows\SysWOW64\csmm.exe
1⤵
- Executes dropped EXE
PID:3300
- C:\Windows\SysWOW64\csmm.exe
  C:\Windows\system32\csmm.exe 1120 "C:\Windows\SysWOW64\csmm.exe"
  2⤵
  PID:316
- - C:\Windows\SysWOW64\csmm.exe
    C:\Windows\SysWOW64\csmm.exe
    3⤵
    PID:4332
  - - C:\Windows\SysWOW64\csmm.exe
      C:\Windows\system32\csmm.exe 1124 "C:\Windows\SysWOW64\csmm.exe"
      4⤵
      PID:2316

C:\Windows\SysWOW64\csmm.exe
C:\Windows\SysWOW64\csmm.exe
1⤵
PID:1960
- C:\Windows\SysWOW64\csmm.exe
  C:\Windows\system32\csmm.exe 1004 "C:\Windows\SysWOW64\csmm.exe"
  2⤵
  PID:4176

C:\Windows\SysWOW64\csmm.exe
C:\Windows\SysWOW64\csmm.exe
1⤵
PID:932
- C:\Windows\SysWOW64\csmm.exe
  C:\Windows\system32\csmm.exe 1120 "C:\Windows\SysWOW64\csmm.exe"
  2⤵
  PID:2536

C:\Windows\SysWOW64\csmm.exe
C:\Windows\SysWOW64\csmm.exe
1⤵
PID:3180
- C:\Windows\SysWOW64\csmm.exe
  C:\Windows\system32\csmm.exe 1120 "C:\Windows\SysWOW64\csmm.exe"
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\csmm.exe
    C:\Windows\SysWOW64\csmm.exe
    3⤵
    PID:4408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\csmm.exe

Filesize
387KB

MD5
2d2710b718ed77053cbddfd72cc731d2

SHA1
e9d19d2eef6f614452f7162af9c4d0664b18f388

SHA256
1626714618c65423a338d433d8080980eb23ebeaa7aa07948584d2daa062171e

SHA512
bcb2486024cb198d4aba2a9a738fb8bc51e078a1fc16529ca57fb59369c6e9ce496a3eff742c422ee586192d1758aa796c64cbded61b9cfe271857cee8afeb09

Download Submit
memory/316-82-0x0000000002320000-0x0000000002410000-memory.dmp

Filesize
960KB

Download
memory/316-89-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/316-81-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/544-5-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/544-7-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/544-2-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/544-26-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/544-25-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/544-4-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/784-8-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/784-0-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/784-1-0x00000000024B0000-0x00000000025A0000-memory.dmp

Filesize
960KB

Download
memory/932-115-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/932-119-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1724-33-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/1724-40-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/1724-22-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/1724-37-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1724-24-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1864-50-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/1864-63-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/1864-65-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1864-67-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/1864-53-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1960-105-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1960-118-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/1960-113-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/1960-117-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2316-94-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/2316-102-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/2316-95-0x0000000002370000-0x0000000002460000-memory.dmp

Filesize
960KB

Download
memory/2536-121-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/2752-66-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2752-79-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/2752-76-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/2848-16-0x00000000023E0000-0x00000000024D0000-memory.dmp

Filesize
960KB

Download
memory/2848-21-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/2848-15-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/3180-69-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/3180-70-0x0000000002340000-0x0000000002430000-memory.dmp

Filesize
960KB

Download
memory/3180-78-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/3300-36-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/3300-51-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3300-39-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3300-90-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3300-54-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/3300-91-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/3300-88-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/3300-77-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3300-43-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4176-108-0x0000000002190000-0x0000000002280000-memory.dmp

Filesize
960KB

Download
memory/4176-114-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4176-107-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4332-92-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4332-104-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4332-101-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4332-103-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4384-29-0x0000000002360000-0x0000000002450000-memory.dmp

Filesize
960KB

Download
memory/4384-38-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4384-28-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4452-57-0x0000000002450000-0x0000000002540000-memory.dmp

Filesize
960KB

Download
memory/4452-64-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4452-56-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4952-52-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download
memory/4952-44-0x00000000023F0000-0x00000000024E0000-memory.dmp

Filesize
960KB

Download
memory/4952-42-0x0000000010000000-0x0000000010417000-memory.dmp

Filesize
4.1MB

Download