modiloader | ee6aecef10f3e4db10a43cf55c68e7dcf8244ff8fe8fb4ff1a25613a5268067b

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 12:02

Target

3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe
Size

6.2MB
MD5

3927fd0550aaf4e60a857e69255251b0
SHA1

35e06e581ab86fbec6706600514631e6fa792dff
SHA256

ee6aecef10f3e4db10a43cf55c68e7dcf8244ff8fe8fb4ff1a25613a5268067b
SHA512

39610f604317f34da26c35757ac735d382f7a8978714bc1a9725b39b9b6075c8141152d8472ae0e015595530c09d210cd013c4026886377ac6b2af5967278497
SSDEEP

49152:t67o62VChONAUK3oDQQU/O523DXOO0MwWj3JvXINHm/UZpbmXSYClwpOaLxdovNM:t67rJoDQQU/M23D7w6pOZZheSYCK3h

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000400000-0x0000000000A33000-memory.dmp	modiloader_stage1
behavioral1/memory/1704-3-0x0000000000400000-0x0000000000A33000-memory.dmp	modiloader_stage1

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2828 1704 WerFault.exe 3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe

pid	pid_target	process	target process
2828	1704	WerFault.exe	3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe

description	pid	process	target process
PID 1704 wrote to memory of 2828	1704	3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe	WerFault.exe
PID 1704 wrote to memory of 2828	1704	3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe	WerFault.exe
PID 1704 wrote to memory of 2828	1704	3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe	WerFault.exe
PID 1704 wrote to memory of 2828	1704	3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3927fd0550aaf4e60a857e69255251b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 652
2⤵
- Program crash
PID:2828

memory/1704-0-0x0000000000400000-0x0000000000A33000-memory.dmp

Filesize
6.2MB

Download
memory/1704-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1704-3-0x0000000000400000-0x0000000000A33000-memory.dmp

Filesize
6.2MB

Download
memory/1704-5-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download