modiloader | 2e584ac69793ddbb064043747fa10caf4d969bf6e65d8dfaf68d1302bbb1cfca

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96d50342db8038f2577817c08e1730f4.exe
Size

586KB
MD5

96d50342db8038f2577817c08e1730f4
SHA1

1c03d3e556783a49e8b1a585fc825ecd5b44bd24
SHA256

2e584ac69793ddbb064043747fa10caf4d969bf6e65d8dfaf68d1302bbb1cfca
SHA512

f4b69d553b673185fe7fb9cc68d687827d98556ef0ae0e37263c66748e2ccd912e9a1f84c23501e1c54ead3119149be35193b43a801d151978259fa82b14489b
SSDEEP

12288:wESTVGNd20hQW85d6F2itF3Z4mxxJ+jAh/078w5jAlCh:toIhQWclitQmXJ+ss7/lAQ

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/1940-5-0x0000000000400000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral2/memory/1940-24-0x0000000000400000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral2/memory/1940-22-0x0000000000400000-0x0000000000516000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1940 set thread context of 3332	1940	96d50342db8038f2577817c08e1730f4.exe	87

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\FieleWay.txt	96d50342db8038f2577817c08e1730f4.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4680	3332	WerFault.exe	87

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3332	1940	96d50342db8038f2577817c08e1730f4.exe	87
PID 1940 wrote to memory of 3332	1940	96d50342db8038f2577817c08e1730f4.exe	87
PID 1940 wrote to memory of 3332	1940	96d50342db8038f2577817c08e1730f4.exe	87
PID 1940 wrote to memory of 3332	1940	96d50342db8038f2577817c08e1730f4.exe	87
PID 1940 wrote to memory of 3332	1940	96d50342db8038f2577817c08e1730f4.exe	87

C:\Users\Admin\AppData\Local\Temp\96d50342db8038f2577817c08e1730f4.exe
"C:\Users\Admin\AppData\Local\Temp\96d50342db8038f2577817c08e1730f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 12
    3⤵
    - Program crash
    PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3332 -ip 3332
1⤵
PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-0-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1940-1-0x00000000022D0000-0x0000000002324000-memory.dmp

Filesize
336KB

Download
memory/1940-2-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1940-5-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1940-3-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1940-4-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1940-6-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/1940-7-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/1940-8-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/1940-9-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1940-10-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1940-11-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1940-12-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/1940-13-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/1940-14-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/1940-15-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/1940-16-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/1940-17-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/1940-18-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/1940-19-0x0000000003560000-0x0000000003561000-memory.dmp

Filesize
4KB

Download
memory/1940-24-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1940-22-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1940-26-0x00000000022D0000-0x0000000002324000-memory.dmp

Filesize
336KB

Download
memory/1940-25-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/3332-21-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download