modiloader | abe355634e3c8d57c10ffd77612b879f827051f5b6ea0be3bd0beab152a7b195

Analysis

max time kernel
142s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 01:59

Target

3f9c282b5cd8f904cf082a3348861347.exe
Size

380KB
MD5

3f9c282b5cd8f904cf082a3348861347
SHA1

2c296488167702f98035b3cbb3373eca9cc23cdd
SHA256

abe355634e3c8d57c10ffd77612b879f827051f5b6ea0be3bd0beab152a7b195
SHA512

5f75392cc36676b259b13e1b2efa62645750ffee7e8be6a950006beadb918951b95b4e8602713bb744c888286654aa77d9fb8764a7e36642f7b40c0669177d16
SSDEEP

6144:veGbAwLaV6qJ0fg3kfC7QLPkWFyNYdT6GcfQCWEhEhg1Y/GwPziuXZ1+ooyhdj:PLagqJqrCcLcaTNCWEhEhL1XZ1Poyhdj

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/1236-21-0x0000000000400000-0x0000000000596000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-22-0x0000000000400000-0x0000000000596000-memory.dmp	modiloader_stage2
behavioral1/memory/1236-33-0x0000000000400000-0x0000000000596000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2616	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2112	rejoice51.exe

Loads dropped DLL 5 IoCs

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_rejoice51.exe	rejoice51.exe
File opened for modification	C:\Windows\SysWOW64\_rejoice51.exe	rejoice51.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	3f9c282b5cd8f904cf082a3348861347.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice51.exe	3f9c282b5cd8f904cf082a3348861347.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice51.exe	3f9c282b5cd8f904cf082a3348861347.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	2112	WerFault.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2112	1236	3f9c282b5cd8f904cf082a3348861347.exe	28
PID 1236 wrote to memory of 2112	1236	3f9c282b5cd8f904cf082a3348861347.exe	28
PID 1236 wrote to memory of 2112	1236	3f9c282b5cd8f904cf082a3348861347.exe	28
PID 1236 wrote to memory of 2112	1236	3f9c282b5cd8f904cf082a3348861347.exe	28
PID 2112 wrote to memory of 2812	2112	rejoice51.exe	29
PID 2112 wrote to memory of 2812	2112	rejoice51.exe	29
PID 2112 wrote to memory of 2812	2112	rejoice51.exe	29
PID 2112 wrote to memory of 2812	2112	rejoice51.exe	29
PID 1236 wrote to memory of 2616	1236	3f9c282b5cd8f904cf082a3348861347.exe	31
PID 1236 wrote to memory of 2616	1236	3f9c282b5cd8f904cf082a3348861347.exe	31
PID 1236 wrote to memory of 2616	1236	3f9c282b5cd8f904cf082a3348861347.exe	31
PID 1236 wrote to memory of 2616	1236	3f9c282b5cd8f904cf082a3348861347.exe	31

C:\Users\Admin\AppData\Local\Temp\3f9c282b5cd8f904cf082a3348861347.exe
"C:\Users\Admin\AppData\Local\Temp\3f9c282b5cd8f904cf082a3348861347.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice51.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice51.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 292
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
  2⤵
  - Deletes itself
  PID:2616

memory/1236-0-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1236-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1236-11-0x00000000023E0000-0x0000000002576000-memory.dmp

Filesize
1.6MB

Download
memory/1236-21-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1236-24-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1236-33-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2112-12-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2112-17-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2112-22-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download