modiloader | 5d0b09993c8b1d6de2ab162c32f2c36fb250b5a8051fbde5d5bcf9e8142ef75d

General

Target
2beadfcc5cc2f725fbaa08d7421d94a4.exe
Size 1.3MB
Sample210310-5jnt19sj4e
SHA256 5d0b09993c8b1d6de2ab162c32f2c36fb250b5a8051fbde5d5bcf9e8142ef75d
MD5 2beadfcc5cc2f725fbaa08d7421d94a4
SHA1 86e79742e9a3b43682022331096dc7fce3ba8de6
SHA512 f007d49f1a274afaa87b601732f784eb62d438a367b17c24e959990aac61cf270e7d2b8bfd677a6cf00e603a12455e759e44d4ca9c635a9db8a446af2790a8f7
MD5 SHA1 SHA512

Score

10^/10

modiloader bootkit persistence spyware stealer trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral2/memory/3600-17-0x0000000000650000-0x00000000006AA000-memory.dmp	modiloader_stage1
behavioral2/memory/3600-19-0x0000000000650000-0x00000000006AA000-memory.dmp	modiloader_stage1

Executes dropped EXE 3 IoCs

pid	Process
992	Com.com
2288	Com.com
3600	Com.com

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mbdCvEVAbP.url	Com.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Com.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2288 set thread context of 3600	2288	Com.com	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2136	PING.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3824	8	2beadfcc5cc2f725fbaa08d7421d94a4.exe	76
PID 8 wrote to memory of 3824	8	2beadfcc5cc2f725fbaa08d7421d94a4.exe	76
PID 8 wrote to memory of 3824	8	2beadfcc5cc2f725fbaa08d7421d94a4.exe	76
PID 8 wrote to memory of 932	8	2beadfcc5cc2f725fbaa08d7421d94a4.exe	78
PID 8 wrote to memory of 932	8	2beadfcc5cc2f725fbaa08d7421d94a4.exe	78
PID 8 wrote to memory of 932	8	2beadfcc5cc2f725fbaa08d7421d94a4.exe	78
PID 932 wrote to memory of 1380	932	cmd.exe	80
PID 932 wrote to memory of 1380	932	cmd.exe	80
PID 932 wrote to memory of 1380	932	cmd.exe	80
PID 1380 wrote to memory of 3624	1380	cmd.exe	83
PID 1380 wrote to memory of 3624	1380	cmd.exe	83
PID 1380 wrote to memory of 3624	1380	cmd.exe	83
PID 1380 wrote to memory of 992	1380	cmd.exe	84
PID 1380 wrote to memory of 992	1380	cmd.exe	84
PID 1380 wrote to memory of 992	1380	cmd.exe	84
PID 1380 wrote to memory of 2136	1380	cmd.exe	86
PID 1380 wrote to memory of 2136	1380	cmd.exe	86
PID 1380 wrote to memory of 2136	1380	cmd.exe	86
PID 992 wrote to memory of 2288	992	Com.com	87
PID 992 wrote to memory of 2288	992	Com.com	87
PID 992 wrote to memory of 2288	992	Com.com	87
PID 2288 wrote to memory of 3600	2288	Com.com	89
PID 2288 wrote to memory of 3600	2288	Com.com	89
PID 2288 wrote to memory of 3600	2288	Com.com	89
PID 2288 wrote to memory of 3600	2288	Com.com	89
PID 2288 wrote to memory of 3600	2288	Com.com	89

C:\Users\Admin\AppData\Local\Temp\2beadfcc5cc2f725fbaa08d7421d94a4.exe
"C:\Users\Admin\AppData\Local\Temp\2beadfcc5cc2f725fbaa08d7421d94a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo qmAzSiYcZ
  2⤵
  PID:3824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Appare.xlsx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^NNBysubwvrLxaUtgPyscanjHImKOLfrklLrHmxtYnJkPBlLmAtZSCBEfATvRcJfuZmlHQbPxqaXJhbunOkhHdkJIuOiFXhCPxtPwZrIrgERpEVwrNYelcIQOQCBeflvNQifoHtmLCpzLzArlMr$" Battito.vob
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com
      Com.com Scolpita.xlm
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com
        
        C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com Scolpita.xlm
        5⤵
        Executes dropped EXE
        Drops startup file
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com
        
        C:\Users\Admin\AppData\Local\Temp\XDTQkkPZNB\Com.com
        6⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        
        PID:3600
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:2136