modiloader | 65c4a676d6b42858be4e09a147bbe8e38623c95fb34240bed2fbab29fb6297e3

Analysis

max time kernel
147s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:54

Target

38ce98e39f4b0d8712a7162009a3290c.exe
Size

711KB
MD5

38ce98e39f4b0d8712a7162009a3290c
SHA1

69a749db15577d5a06ee2d2cc512b5abcfa3482f
SHA256

65c4a676d6b42858be4e09a147bbe8e38623c95fb34240bed2fbab29fb6297e3
SHA512

841cc9ab6124f636f6c5bded0e7c4b89f76a6df9161158abe81275181737c6b83a352f838ca497afad93cc8242665308931350fcaf502128a89d029d9db13035
SSDEEP

12288:V8qBOLLPg7DFgKPJf/eQYzkqp0MjbyBXa9PBC+dGn1wydZslK9:VfBOLs7qKEZZbyGBJdA9

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1384-3-0x0000000000400000-0x00000000004B8200-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	38ce98e39f4b0d8712a7162009a3290c.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2728	1384	38ce98e39f4b0d8712a7162009a3290c.exe	18
PID 1384 wrote to memory of 2728	1384	38ce98e39f4b0d8712a7162009a3290c.exe	18

C:\Users\Admin\AppData\Local\Temp\38ce98e39f4b0d8712a7162009a3290c.exe
"C:\Users\Admin\AppData\Local\Temp\38ce98e39f4b0d8712a7162009a3290c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1384
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2728

memory/1384-0-0x0000000000400000-0x00000000004B8200-memory.dmp

Filesize
736KB

Download
memory/1384-3-0x0000000000400000-0x00000000004B8200-memory.dmp

Filesize
736KB

Download
memory/1384-1-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download