Behavioral task
behavioral1
Sample
2be0000.dll
Resource
win10v2004-20250314-en
General
-
Target
2be0000.dll
-
Size
477.1MB
-
MD5
5cb629adb12c7a0a54dea9903d6e2f86
-
SHA1
609fffad008280c7b9d21ce538e88ec3c920466e
-
SHA256
1a55e9e2871c1ae5dd1ffdca5bef84e7ff1efb5bd631f3c2dc93f0a8fd7c1da3
-
SHA512
828a6eaa13a9ae5801039515866d915eb7ec0348b2a64ffce6e1aa519b041c788982d9c13a6bf80a8cbcf8f867bbc49569b3b2cba2b5bddbd6c8d23670dab8e9
-
SSDEEP
6144:bKiIi5fNqnKrrLeOZYeBz20+Si8ZWOTPICRZQzHIy:V5fMKrHeiaOjBy
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2be0000.dll
Files
-
2be0000.dll.dll windows:4 windows x86 arch:x86
25bfbdde0bedb22e9d7c8eeb9f9ad1d7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetUserNameA
user32
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
TranslateMessage
MessageBoxA
LoadStringA
GetSystemMetrics
GetMessageA
DispatchMessageA
CharNextA
CharToOemA
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlen
lstrcpyn
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrcmpi
WriteProcessMemory
WriteFile
WaitForSingleObject
VirtualQuery
SetThreadContext
SetFilePointer
SetEvent
SetEndOfFile
ResetEvent
ReadFile
LoadLibraryExA
LoadLibraryW
LoadLibraryA
LeaveCriticalSection
IsBadWritePtr
IsBadReadPtr
InitializeCriticalSection
GetVersionExA
GetThreadLocale
GetThreadContext
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcess
GetCPInfo
FreeLibrary
FormatMessageA
ExitProcess
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
Sleep
winmm
timeSetEvent
c:\windows\system32\ntdll
NtResumeThread
url
InetIsOffline
ntdll
NtQueryInformationFile
NtOpenFile
NtClose
NtWriteFile
NtReadFile
NtCreateFile
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlInitUnicodeString
Sections
. Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
. Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
. Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 16KB - Virtual size: 16KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
. Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ