modiloader | c263169910fb7ed76170663caa621410b3b77e2c8efe5a19643cf14df27f1b8f

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 06:04

Target
83a4041e386a3a4ba6422d964b80ff46.dll
Size 321KB
Sample240131-gsm3eseegn
SHA256 c263169910fb7ed76170663caa621410b3b77e2c8efe5a19643cf14df27f1b8f
MD5 83a4041e386a3a4ba6422d964b80ff46
SHA1 95a2013879701e25d961ab3e7bd91df7875e4d6d
SHA512 000564e02de6d9e8233aa86ad3f35ffba43625a76f1b3e17ab6d75072e6fb732eea23ae00fbd403bbe1c3daf7a483d96eae640e62d3d7ffe9212e0bfea4a8692
SSDEEP 6144:JFU2oXPs6CmhDu6PdsjVwupvUkZhWc0O9oaoasBCX4VZMQSatM81fLMBc:noXPvC8D+vbsqoVZhSattN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1152-0-0x0000000000400000-0x0000000000458000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 1152	3668	rundll32.exe	17
PID 3668 wrote to memory of 1152	3668	rundll32.exe	17
PID 3668 wrote to memory of 1152	3668	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83a4041e386a3a4ba6422d964b80ff46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83a4041e386a3a4ba6422d964b80ff46.dll,#1
  2⤵
  PID:1152

memory/1152-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download