modiloader | 03cf03d1cb4fa502ef1992e2aad3f1f7f0d7fbf1f16839d87eaa04f330211bbe

General

Target

USD_ Payment Schedule.xls
Size

330KB
MD5

9f32ff59ea65adff3fa4350db7db6534
SHA1

fa29ea0f3c997ef85c9fbd0a3f27d57344f15dd1
SHA256

03cf03d1cb4fa502ef1992e2aad3f1f7f0d7fbf1f16839d87eaa04f330211bbe
SHA512

062ce1a27b51714fb9f8273a67e117dca1c61665d3eb43ffcd619a6c294e4ba8fc997c70b087d66d053cf743d1715f6c562859e3d84e72283920acff76cd8aad

Score

10^/10

modiloader ransomware trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe	modiloader_stage1
\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe	modiloader_stage1
\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe	modiloader_stage1
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe	modiloader_stage1

Executes dropped EXE 1 IoCs

Processes:

PFUCSVF.exe

pid process

1636 PFUCSVF.exe
Loads dropped DLL 3 IoCs

Processes:

EXCEL.EXE

pid process

1108 EXCEL.EXE
1108 EXCEL.EXE
1108 EXCEL.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
1636	PFUCSVF.exe

pid	process
1108	EXCEL.EXE
1108	EXCEL.EXE
1108	EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 13 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1108 EXCEL.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

PFUCSVF.exe

pid process

1636 PFUCSVF.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

EXCEL.EXEPFUCSVF.exe

pid process

1108 EXCEL.EXE
1108 EXCEL.EXE
1108 EXCEL.EXE
1636 PFUCSVF.exe
1636 PFUCSVF.exe

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1108	EXCEL.EXE

pid	process
1636	PFUCSVF.exe

pid	process
1108	EXCEL.EXE
1108	EXCEL.EXE
1108	EXCEL.EXE
1636	PFUCSVF.exe
1636	PFUCSVF.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 1108 wrote to memory of 1636	1108	EXCEL.EXE	PFUCSVF.exe
PID 1108 wrote to memory of 1636	1108	EXCEL.EXE	PFUCSVF.exe
PID 1108 wrote to memory of 1636	1108	EXCEL.EXE	PFUCSVF.exe
PID 1108 wrote to memory of 1636	1108	EXCEL.EXE	PFUCSVF.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\USD_ Payment Schedule.xls"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe
MD5
473e05acc6195bf707b34546e23d31ed

SHA1
43f800228bf4401a06ad271470ac7f415eccc864

SHA256
73fccc2e9290fb5baad4bee3010ebc2835cbeb4fe35da0a822e2fd9793e2ad28

SHA512
8d806b3bca31d1e0e021ee11102b5f41259857946ac6bbaba77070fc7d39eaa10192bb565459b9cd0a64ffdca7a58ac4914719090e16cfbe94ba763e2bfb11eb

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe
MD5
473e05acc6195bf707b34546e23d31ed

SHA1
43f800228bf4401a06ad271470ac7f415eccc864

SHA256
73fccc2e9290fb5baad4bee3010ebc2835cbeb4fe35da0a822e2fd9793e2ad28

SHA512
8d806b3bca31d1e0e021ee11102b5f41259857946ac6bbaba77070fc7d39eaa10192bb565459b9cd0a64ffdca7a58ac4914719090e16cfbe94ba763e2bfb11eb

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe
MD5
473e05acc6195bf707b34546e23d31ed

SHA1
43f800228bf4401a06ad271470ac7f415eccc864

SHA256
73fccc2e9290fb5baad4bee3010ebc2835cbeb4fe35da0a822e2fd9793e2ad28

SHA512
8d806b3bca31d1e0e021ee11102b5f41259857946ac6bbaba77070fc7d39eaa10192bb565459b9cd0a64ffdca7a58ac4914719090e16cfbe94ba763e2bfb11eb

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFUCSVF.exe
MD5
473e05acc6195bf707b34546e23d31ed

SHA1
43f800228bf4401a06ad271470ac7f415eccc864

SHA256
73fccc2e9290fb5baad4bee3010ebc2835cbeb4fe35da0a822e2fd9793e2ad28

SHA512
8d806b3bca31d1e0e021ee11102b5f41259857946ac6bbaba77070fc7d39eaa10192bb565459b9cd0a64ffdca7a58ac4914719090e16cfbe94ba763e2bfb11eb

Download Submit
memory/1108-2-0x000000002FF41000-0x000000002FF44000-memory.dmp

Filesize
12KB

Download
memory/1108-3-0x0000000071251000-0x0000000071253000-memory.dmp

Filesize
8KB

Download
memory/1108-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1636-9-0x0000000000000000-mapping.dmp

Download
memory/1636-11-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1636-12-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1972-5-0x000007FEF7510000-0x000007FEF778A000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads