modiloader | 867c85168812654c8ded87e802a0b3e220362d3b5822aef7ed9cc75be1961d79

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 22:27

Target

54bfbe067c074db7fb5c9d90bccd8460.exe
Size

699KB
MD5

54bfbe067c074db7fb5c9d90bccd8460
SHA1

33e788fd7e190ac96650e1e75dbd7f6ea96b87e0
SHA256

867c85168812654c8ded87e802a0b3e220362d3b5822aef7ed9cc75be1961d79
SHA512

710bad26e6c862f39b9010f3d24e97eb0e0896dcb4c70f035bf7475937e744709be5c3d750b22ec818056c3ddf226a005912ebfb430fd235b2ef4d5b411b6d6d
SSDEEP

12288:dFUuKT63xR5kuzwb3cIgnVKbW3G2voAIYrqOAuaM+TW7vr8:3pD3xoukcIajfvxdeuaM+TW7T8

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2552-3-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	54bfbe067c074db7fb5c9d90bccd8460.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4856	2552	54bfbe067c074db7fb5c9d90bccd8460.exe	90
PID 2552 wrote to memory of 4856	2552	54bfbe067c074db7fb5c9d90bccd8460.exe	90
PID 2552 wrote to memory of 4856	2552	54bfbe067c074db7fb5c9d90bccd8460.exe	90

C:\Users\Admin\AppData\Local\Temp\54bfbe067c074db7fb5c9d90bccd8460.exe
"C:\Users\Admin\AppData\Local\Temp\54bfbe067c074db7fb5c9d90bccd8460.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\system32\mstsc.exe"
  2⤵
  PID:4856

memory/2552-1-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2552-3-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download