modiloader | 5d0b09993c8b1d6de2ab162c32f2c36fb250b5a8051fbde5d5bcf9e8142ef75d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7v20201028
submitted
10/03/2021, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2beadfcc5cc2f725fbaa08d7421d94a4.exe
Size 1.3MB
Sample210310-5jnt19sj4e
SHA256 5d0b09993c8b1d6de2ab162c32f2c36fb250b5a8051fbde5d5bcf9e8142ef75d
MD5 2beadfcc5cc2f725fbaa08d7421d94a4
SHA1 86e79742e9a3b43682022331096dc7fce3ba8de6
SHA512 f007d49f1a274afaa87b601732f784eb62d438a367b17c24e959990aac61cf270e7d2b8bfd677a6cf00e603a12455e759e44d4ca9c635a9db8a446af2790a8f7
MD5 SHA1 SHA512

Score

10^/10

modiloader bootkit persistence spyware stealer trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral1/memory/468-23-0x0000000000080000-0x00000000000DA000-memory.dmp	modiloader_stage1
behavioral1/memory/468-25-0x0000000000080000-0x00000000000DA000-memory.dmp	modiloader_stage1

Executes dropped EXE 3 IoCs

pid	Process
268	Com.com
612	Com.com
468	Com.com

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mbdCvEVAbP.url	Com.com

Loads dropped DLL 3 IoCs

pid	Process
1900	cmd.exe
268	Com.com
612	Com.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Com.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 612 set thread context of 468	612	Com.com	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
564	PING.EXE

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1148	1152	2beadfcc5cc2f725fbaa08d7421d94a4.exe	26
PID 1152 wrote to memory of 1148	1152	2beadfcc5cc2f725fbaa08d7421d94a4.exe	26
PID 1152 wrote to memory of 1148	1152	2beadfcc5cc2f725fbaa08d7421d94a4.exe	26
PID 1152 wrote to memory of 1148	1152	2beadfcc5cc2f725fbaa08d7421d94a4.exe	26
PID 1152 wrote to memory of 1968	1152	2beadfcc5cc2f725fbaa08d7421d94a4.exe	28
PID 1152 wrote to memory of 1968	1152	2beadfcc5cc2f725fbaa08d7421d94a4.exe	28
PID 1152 wrote to memory of 1968	1152	2beadfcc5cc2f725fbaa08d7421d94a4.exe	28
PID 1152 wrote to memory of 1968	1152	2beadfcc5cc2f725fbaa08d7421d94a4.exe	28
PID 1968 wrote to memory of 1900	1968	cmd.exe	30
PID 1968 wrote to memory of 1900	1968	cmd.exe	30
PID 1968 wrote to memory of 1900	1968	cmd.exe	30
PID 1968 wrote to memory of 1900	1968	cmd.exe	30
PID 1900 wrote to memory of 784	1900	cmd.exe	34
PID 1900 wrote to memory of 784	1900	cmd.exe	34
PID 1900 wrote to memory of 784	1900	cmd.exe	34
PID 1900 wrote to memory of 784	1900	cmd.exe	34
PID 1900 wrote to memory of 268	1900	cmd.exe	35
PID 1900 wrote to memory of 268	1900	cmd.exe	35
PID 1900 wrote to memory of 268	1900	cmd.exe	35
PID 1900 wrote to memory of 268	1900	cmd.exe	35
PID 1900 wrote to memory of 564	1900	cmd.exe	36
PID 1900 wrote to memory of 564	1900	cmd.exe	36
PID 1900 wrote to memory of 564	1900	cmd.exe	36
PID 1900 wrote to memory of 564	1900	cmd.exe	36
PID 268 wrote to memory of 612	268	Com.com	37
PID 268 wrote to memory of 612	268	Com.com	37
PID 268 wrote to memory of 612	268	Com.com	37
PID 268 wrote to memory of 612	268	Com.com	37
PID 612 wrote to memory of 468	612	Com.com	38
PID 612 wrote to memory of 468	612	Com.com	38
PID 612 wrote to memory of 468	612	Com.com	38
PID 612 wrote to memory of 468	612	Com.com	38
PID 612 wrote to memory of 468	612	Com.com	38
PID 612 wrote to memory of 468	612	Com.com	38

C:\Users\Admin\AppData\Local\Temp\2beadfcc5cc2f725fbaa08d7421d94a4.exe
"C:\Users\Admin\AppData\Local\Temp\2beadfcc5cc2f725fbaa08d7421d94a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo qmAzSiYcZ
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Appare.xlsx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^NNBysubwvrLxaUtgPyscanjHImKOLfrklLrHmxtYnJkPBlLmAtZSCBEfATvRcJfuZmlHQbPxqaXJhbunOkhHdkJIuOiFXhCPxtPwZrIrgERpEVwrNYelcIQOQCBeflvNQifoHtmLCpzLzArlMr$" Battito.vob
      4⤵
      PID:784
  - - C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com
      Com.com Scolpita.xlm
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:268
    - - C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com
        
        C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com Scolpita.xlm
        5⤵
        Executes dropped EXE
        Drops startup file
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:612
      - C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com
        
        C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com
        6⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        
        PID:468
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-25-0x0000000000080000-0x00000000000DA000-memory.dmp

Download

memory/468-23-0x0000000000080000-0x00000000000DA000-memory.dmp

Download

memory/612-22-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/1152-2-0x00000000760C1000-0x00000000760C3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads