modiloader | 8457f4e365d4f7eac1702d769efc61d2e7e9e021a960de64a4e5a2c2aa71d152

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 10:23

Target

45a89780923c6714f11fdb3511e34c6b.exe
Size

585KB
MD5

45a89780923c6714f11fdb3511e34c6b
SHA1

ed155242f9e8418e1d492c111bae471a49c6b280
SHA256

8457f4e365d4f7eac1702d769efc61d2e7e9e021a960de64a4e5a2c2aa71d152
SHA512

897c340df1f2bd73b17a29e4b68ce9f509ed1929b630e58e79c25199f14d524504e6c406ce52899ca9e2cab857ead470003ea258cf63b681f9f35ee2bc0143bd
SSDEEP

12288:iiYsg5sHxJLvbPp9QhSR2LYk2D4pTeWUp5W3:DgixtbPvQk1Tp5W3

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2444-2-0x0000000000400000-0x0000000000577000-memory.dmp	modiloader_stage2
behavioral1/memory/2444-5-0x0000000000400000-0x0000000000577000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	45a89780923c6714f11fdb3511e34c6b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2328	2444	45a89780923c6714f11fdb3511e34c6b.exe	20
PID 2444 wrote to memory of 2328	2444	45a89780923c6714f11fdb3511e34c6b.exe	20
PID 2444 wrote to memory of 2328	2444	45a89780923c6714f11fdb3511e34c6b.exe	20
PID 2444 wrote to memory of 2328	2444	45a89780923c6714f11fdb3511e34c6b.exe	20

C:\Users\Admin\AppData\Local\Temp\45a89780923c6714f11fdb3511e34c6b.exe
"C:\Users\Admin\AppData\Local\Temp\45a89780923c6714f11fdb3511e34c6b.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2444
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2328

memory/2444-1-0x0000000000400000-0x0000000000577000-memory.dmp

Filesize
1.5MB

Download
memory/2444-2-0x0000000000400000-0x0000000000577000-memory.dmp

Filesize
1.5MB

Download
memory/2444-0-0x0000000000400000-0x0000000000577000-memory.dmp

Filesize
1.5MB

Download
memory/2444-5-0x0000000000400000-0x0000000000577000-memory.dmp

Filesize
1.5MB

Download
memory/2444-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download