modiloader | 867c85168812654c8ded87e802a0b3e220362d3b5822aef7ed9cc75be1961d79

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 22:27

Target

54bfbe067c074db7fb5c9d90bccd8460.exe
Size

699KB
MD5

54bfbe067c074db7fb5c9d90bccd8460
SHA1

33e788fd7e190ac96650e1e75dbd7f6ea96b87e0
SHA256

867c85168812654c8ded87e802a0b3e220362d3b5822aef7ed9cc75be1961d79
SHA512

710bad26e6c862f39b9010f3d24e97eb0e0896dcb4c70f035bf7475937e744709be5c3d750b22ec818056c3ddf226a005912ebfb430fd235b2ef4d5b411b6d6d
SSDEEP

12288:dFUuKT63xR5kuzwb3cIgnVKbW3G2voAIYrqOAuaM+TW7vr8:3pD3xoukcIajfvxdeuaM+TW7T8

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/1720-6-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral1/memory/1620-8-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 1720	1620	54bfbe067c074db7fb5c9d90bccd8460.exe	28

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	54bfbe067c074db7fb5c9d90bccd8460.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1720	1620	54bfbe067c074db7fb5c9d90bccd8460.exe	28
PID 1620 wrote to memory of 1720	1620	54bfbe067c074db7fb5c9d90bccd8460.exe	28
PID 1620 wrote to memory of 1720	1620	54bfbe067c074db7fb5c9d90bccd8460.exe	28
PID 1620 wrote to memory of 1720	1620	54bfbe067c074db7fb5c9d90bccd8460.exe	28
PID 1620 wrote to memory of 1720	1620	54bfbe067c074db7fb5c9d90bccd8460.exe	28
PID 1620 wrote to memory of 1720	1620	54bfbe067c074db7fb5c9d90bccd8460.exe	28

C:\Users\Admin\AppData\Local\Temp\54bfbe067c074db7fb5c9d90bccd8460.exe
"C:\Users\Admin\AppData\Local\Temp\54bfbe067c074db7fb5c9d90bccd8460.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\system32\mstsc.exe"
  2⤵
  PID:1720

memory/1620-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1620-8-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1720-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1720-4-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1720-6-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download