modiloader | 63f842dd168caff5a6c32cd15cf8025459489ef15ba7d01b07af13aad3d348c5

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 02:53

Target

39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034_dump.bin.dll
Size

284KB
MD5

94a4956b383842cfcaadaecf07249f48
SHA1

1ff11b9bf098fa173f887d3f66b8066db8027071
SHA256

63f842dd168caff5a6c32cd15cf8025459489ef15ba7d01b07af13aad3d348c5
SHA512

c40c7e32f21631294a1d29516308db4219a9ed805d39cc4e12023de261f57418ad8c26a062f856bd2ade09a0eaf65da943778ae2e6e302d5d22dc2e6048fcdf1
SSDEEP

6144:1Q6PpWjDN4Z+6aB+Cl8VabJO2NRPS1AnWlnrE/HFuilU2pnd1hPWnU0f79uW6E/X:nWjDiDYoB2lhMsw

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/828-0-0x0000000000400000-0x0000000000447000-memory.dmp	modiloader_stage2
behavioral2/memory/828-1-0x0000000000400000-0x0000000000447000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 956 wrote to memory of 828	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 828	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 828	956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034_dump.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034_dump.bin.dll,#1
2⤵
PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5244 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4564

memory/828-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/828-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download