modiloader | 4d1682d29abfc856ff5b12debed6e8a669947b0680c652e6228c7b21ce0cf250

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 09:26

Target
8ecb4288d0429af34167388fc177351a.exe
Size 676KB
Sample240204-ld769sebc8
SHA256 4d1682d29abfc856ff5b12debed6e8a669947b0680c652e6228c7b21ce0cf250
MD5 8ecb4288d0429af34167388fc177351a
SHA1 d49d025882d6f003e7c9c1427fd6cb0b1cd276e7
SHA512 9b7390e3f579065dd2bf1a12a780d18e2151ec614bb44baf2ad7eef1b42ae780ef796c9e467ecf130f03109276d829886dcc664999e56dd9b6e93ab84bf1d7e4
SSDEEP 12288:Jrv0J2PVbzOIfSGAhTcwGAVnxPdAWSC8brs+Ty8NK:FK2PdOIfJAW7yxVPurs+T4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2544-2-0x0000000000400000-0x00000000004BA000-memory.dmp	modiloader_stage2

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SetupWay.txt	8ecb4288d0429af34167388fc177351a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2300	2544	8ecb4288d0429af34167388fc177351a.exe	28
PID 2544 wrote to memory of 2300	2544	8ecb4288d0429af34167388fc177351a.exe	28
PID 2544 wrote to memory of 2300	2544	8ecb4288d0429af34167388fc177351a.exe	28
PID 2544 wrote to memory of 2300	2544	8ecb4288d0429af34167388fc177351a.exe	28

C:\Users\Admin\AppData\Local\Temp\8ecb4288d0429af34167388fc177351a.exe
"C:\Users\Admin\AppData\Local\Temp\8ecb4288d0429af34167388fc177351a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2544
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2300

memory/2544-1-0x0000000000270000-0x0000000000271000-memory.dmp

Download

memory/2544-2-0x0000000000400000-0x00000000004BA000-memory.dmp

Download