modiloader | 3cad10488e9efd31ba0fe6cacc311572a2fac4c4760b315e5ce337ea731ce22c

Analysis

max time kernel
119s
max time network
141s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe
Size

649KB
MD5

3c37c322eabf6eda7375d85e15e3c6e3
SHA1

a6cf2cbcf8aee310c4bde6b846a83a91b3855c46
SHA256

3cad10488e9efd31ba0fe6cacc311572a2fac4c4760b315e5ce337ea731ce22c
SHA512

dfb235f3db2401554e070dc4ba6add57360e8a3327537f83c9fb6397d2b87fae614dba67888ce286f9b8beaab3b34ca903b7bf0bae7705d7402e6615d4822757

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ymtc = "C:\\Users\\Admin\\AppData\\Local\\Ymtc\\Ymtc.hta"	SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe

description	pid	process	target process
PID 1520 wrote to memory of 3768	1520	SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe	ieinstal.exe
PID 1520 wrote to memory of 3768	1520	SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe	ieinstal.exe
PID 1520 wrote to memory of 3768	1520	SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.AI.Packer.F6FD72BA21.14573.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1520

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:3768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads