modiloader | ca8ff130b779ec10cfa89d4964fe644698a70dfe5450b88416f149b7a5162cab

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 12:24

Target

abde681314cb2ac7e85de0de9968a169.exe
Size

267KB
MD5

abde681314cb2ac7e85de0de9968a169
SHA1

30c5e3285768cfba045e8c610c8f87021e15359e
SHA256

ca8ff130b779ec10cfa89d4964fe644698a70dfe5450b88416f149b7a5162cab
SHA512

08e2c3f61eb6acbc110723c0e1bf4bebc41805c523004f94a13708d91e2c41394c712a5dd69dfea6a9dc77b39db49c010f2a3eb377f1ea1631c58c5cb223ca1b
SSDEEP

6144:rJ01GYlMWwdKAHNU13B/7SGryfq/Xn4GMdKY2t+Y5bB7snG4WJP1:r+1fCWRTSG2y/X4G2KLt+YdB7snGTR1

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2272-2-0x0000000000400000-0x0000000000501000-memory.dmp	modiloader_stage2
behavioral1/memory/2272-5-0x0000000000400000-0x0000000000501000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt	abde681314cb2ac7e85de0de9968a169.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2576	2272	abde681314cb2ac7e85de0de9968a169.exe	28
PID 2272 wrote to memory of 2576	2272	abde681314cb2ac7e85de0de9968a169.exe	28
PID 2272 wrote to memory of 2576	2272	abde681314cb2ac7e85de0de9968a169.exe	28
PID 2272 wrote to memory of 2576	2272	abde681314cb2ac7e85de0de9968a169.exe	28

C:\Users\Admin\AppData\Local\Temp\abde681314cb2ac7e85de0de9968a169.exe
"C:\Users\Admin\AppData\Local\Temp\abde681314cb2ac7e85de0de9968a169.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2272
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2576

memory/2272-0-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2272-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2272-2-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2272-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2272-5-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download