modiloader | 8be40e5f245aaa3a3d114ff16a7598877806115cf8dcf819fc231c2ac571ed76

General

Target

Loading-Document.exe
Size

1.1MB
MD5

d3a33281c280e948524c6f1d98e50b27
SHA1

38a9f16d5586f5ac76489723aa4744c483544e85
SHA256

8be40e5f245aaa3a3d114ff16a7598877806115cf8dcf819fc231c2ac571ed76
SHA512

2850a92f9129eb2a68b37c835428b4f80a81a3c54cd699665757d56e61764052ecaec5da1a9944466819fc384d5a97cebbdd958fd37303936e7b0df9bce88c46

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Zbwz = "C:\\Users\\Admin\\AppData\\Local\\Zbwz\\Zbwz.hta"	Loading-Document.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24
PID 1088 wrote to memory of 1412	1088	Loading-Document.exe	24

C:\Users\Admin\AppData\Local\Temp\Loading-Document.exe
"C:\Users\Admin\AppData\Local\Temp\Loading-Document.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  PID:1412