Behavioral task
behavioral1
Sample
63f842dd168caff5a6c32cd15cf8025459489ef15ba7d01b07af13aad3d348c5.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
63f842dd168caff5a6c32cd15cf8025459489ef15ba7d01b07af13aad3d348c5.dll
Resource
win10v2004-20240508-en
General
-
Target
63f842dd168caff5a6c32cd15cf8025459489ef15ba7d01b07af13aad3d348c5.dll
-
Size
284KB
-
MD5
94a4956b383842cfcaadaecf07249f48
-
SHA1
1ff11b9bf098fa173f887d3f66b8066db8027071
-
SHA256
63f842dd168caff5a6c32cd15cf8025459489ef15ba7d01b07af13aad3d348c5
-
SHA512
c40c7e32f21631294a1d29516308db4219a9ed805d39cc4e12023de261f57418ad8c26a062f856bd2ade09a0eaf65da943778ae2e6e302d5d22dc2e6048fcdf1
-
SSDEEP
6144:1Q6PpWjDN4Z+6aB+Cl8VabJO2NRPS1AnWlnrE/HFuilU2pnd1hPWnU0f79uW6E/X:nWjDiDYoB2lhMsw
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 63f842dd168caff5a6c32cd15cf8025459489ef15ba7d01b07af13aad3d348c5.dll
Files
-
63f842dd168caff5a6c32cd15cf8025459489ef15ba7d01b07af13aad3d348c5.dll.dll windows:4 windows x86 arch:x86
c2f49b103872e268b73e5d395a22973c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
GetErrorInfo
SysFreeString
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegCloseKey
CreateProcessAsUserW
user32
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
TranslateMessage
MessageBoxA
LoadStringA
GetSystemMetrics
GetMessageA
DispatchMessageA
CharNextA
CharToOemA
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
WriteFile
WinExec
WaitForSingleObject
VirtualQuery
SetThreadContext
SetFilePointer
SetEvent
SetEndOfFile
ResetEvent
ReadFile
MultiByteToWideChar
LoadLibraryW
LeaveCriticalSection
IsBadWritePtr
IsBadReadPtr
InitializeCriticalSection
GetVersionExA
GetTickCount
GetThreadLocale
GetThreadContext
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcess
GetCPInfo
FreeLibrary
FormatMessageA
ExitProcess
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
Sleep
winmm
timeSetEvent
ole32
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize
c:\windows\system32\ntdll
NtWriteVirtualMemory
NtReadVirtualMemory
NtResumeThread
c:\windows\system32\kernelbase
EnumSystemLocalesA
url
InetIsOffline
ntdll
NtQueryInformationFile
NtOpenFile
NtClose
NtWriteFile
NtReadFile
NtCreateFile
NtUnmapViewOfSection
RtlMoveMemory
RtlDosPathNameToNtPathName_U
wininet
InternetCheckConnectionA
Sections
. Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
. Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
. Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 16KB - Virtual size: 16KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
. Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ