modiloader | f3ad47ca842225f405e277f5f2b0521266fe65a90bf746ac39a67990835ddf14

General

Target

Document.exe
Size

753KB
MD5

abb973cc735baa96deac84f5653fd89a
SHA1

59c52bab6062e461866be8b918a376e4362571e1
SHA256

f3ad47ca842225f405e277f5f2b0521266fe65a90bf746ac39a67990835ddf14
SHA512

b44074cc3a0b114e3580c2222c29782d42c814ab365731a97c3f76bbc62206a6cd59a12f86d16aeeb8004c84d5ad871bf2b058d291dfb66cf2fd138e0159b59b

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Document.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Clnzfd = "C:\\Users\\Public\\Libraries\\dfznlC.url"	Document.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Document.exe

description	pid	process	target process
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe
PID 1864 wrote to memory of 1488	1864	Document.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\Document.exe
"C:\Users\Admin\AppData\Local\Temp\Document.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1864

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:1488

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-60-0x0000000000000000-mapping.dmp

Download
memory/1488-61-0x0000000076A81000-0x0000000076A83000-memory.dmp

Filesize
8KB

Download
memory/1488-63-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1488-62-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1488-66-0x0000000010550000-0x0000000010586000-memory.dmp

Filesize
216KB

Download
memory/1488-65-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1488-67-0x0000000000190000-0x00000000001C4000-memory.dmp

Filesize
208KB

Download
memory/1864-59-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing