modiloader | da31c02c004f7e04408dea6429c362b4870c87a99fb2ae8ace1dac200a7fce5d

General

Target

Doc00118871655141998.scr
Size

950KB
MD5

60c579a32e2cc16c804692018a64fa84
SHA1

1ffe13bd73cf63b6ee0b6401cefd905a24cbb8a3
SHA256

da31c02c004f7e04408dea6429c362b4870c87a99fb2ae8ace1dac200a7fce5d
SHA512

48722d955395afd6c89e81b371b9c0db9e3d362dbe31fbe8a7e7d2cf741790e8d5a19cf990afc83d01297be2d4d96451b9c06625118ed767ae18d9b30db0a181

Score

10^/10

modiloader warzonerat infostealer persistence rat trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1944-2-0x0000000000290000-0x00000000002AB000-memory.dmp	modiloader_stage1

Warzone RAT Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1148-11-0x0000000000000000-mapping.dmp	warzonerat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Doc00118871655141998.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\oarD = "C:\\Users\\Admin\\AppData\\Local\\oarD.url"	Doc00118871655141998.scr

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Doc00118871655141998.scr

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Doc00118871655141998.scr
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Doc00118871655141998.scr
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Doc00118871655141998.scr

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Doc00118871655141998.scr

description	pid	process	target process
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe
PID 1944 wrote to memory of 1148	1944	Doc00118871655141998.scr	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\Doc00118871655141998.scr
"C:\Users\Admin\AppData\Local\Temp\Doc00118871655141998.scr" /S
1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1944

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-4-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1148-5-0x0000000000000000-mapping.dmp

Download
memory/1148-6-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1148-7-0x0000000000000000-mapping.dmp

Download
memory/1148-9-0x0000000000000000-mapping.dmp

Download
memory/1148-10-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1148-11-0x0000000000000000-mapping.dmp

Download
memory/1828-3-0x000007FEF7430000-0x000007FEF76AA000-memory.dmp

Filesize
2.5MB

Download
memory/1944-2-0x0000000000290000-0x00000000002AB000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads