modiloader | f159eff411bfdcafe5c8bb6d7c26a11f159723aa55632f00f1e11c31cde3c86c

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 21:27

Target
8a92e0e97c807455df946243fe815930.dll
Size 148KB
Sample240202-1avt4aabbq
SHA256 f159eff411bfdcafe5c8bb6d7c26a11f159723aa55632f00f1e11c31cde3c86c
MD5 8a92e0e97c807455df946243fe815930
SHA1 a74262225a706a8acfb447e08b9c2aae38468219
SHA512 56ba6b2f4378b2ac87e078f1985f48f5ba1d53847a2508657f0c156de75c6b2d0775c4f1aa9244dd9efdc308e0aaca8d3188af527dd00c3b5429def4e23d41fe
SSDEEP 1536:8l4qmQbmmelfzPPuiHCj/uwd3DiB3AgpXsATaEOO2n:tKDUz+Qwd32B3xpXbOBn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3288-0-0x00000000003C0000-0x00000000003E5000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4952	3288	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3288	640	regsvr32.exe	85
PID 640 wrote to memory of 3288	640	regsvr32.exe	85
PID 640 wrote to memory of 3288	640	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8a92e0e97c807455df946243fe815930.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8a92e0e97c807455df946243fe815930.dll
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 672
    3⤵
    - Program crash
    PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3288 -ip 3288
1⤵
PID:1140

memory/3288-0-0x00000000003C0000-0x00000000003E5000-memory.dmp

Download