modiloader | 0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 19:02

Target

0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503.exe
Size

5.7MB
MD5

a9a6952ef9ec0898ad38ba29f049533b
SHA1

92563c372f3974138db537593c8356928ac2c5a6
SHA256

0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503
SHA512

c1c214b48b48a9853b5a97c236888df7266f4c819c196a7d25d18b89d2716eb271654ff2c7a0f15a81a4a734592a32c09035e90f84952383277cd5a8fefa6264
SSDEEP

49152:QKiJFsmOoPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP0Pa:yJFBr51r5D

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2064-2-0x0000000000400000-0x0000000000900000-memory.dmp	modiloader_stage2
behavioral1/memory/2064-5-0x0000000000400000-0x0000000000900000-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\2010.txt	0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2836	2064	0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503.exe	28
PID 2064 wrote to memory of 2836	2064	0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503.exe	28
PID 2064 wrote to memory of 2836	2064	0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503.exe	28
PID 2064 wrote to memory of 2836	2064	0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503.exe	28

C:\Users\Admin\AppData\Local\Temp\0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503.exe
"C:\Users\Admin\AppData\Local\Temp\0359d472c709a2818d98bd405db26e44c76a18233b1b2f2a5a688f6c9e7c3503.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2064
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2836

memory/2064-0-0x0000000000400000-0x0000000000900000-memory.dmp

Filesize
5.0MB

Download
memory/2064-1-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2064-2-0x0000000000400000-0x0000000000900000-memory.dmp

Filesize
5.0MB

Download
memory/2064-3-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2064-5-0x0000000000400000-0x0000000000900000-memory.dmp

Filesize
5.0MB

Download