modiloader | 10f5584682c3f5d54ba1e3afd68822c81e8234531c8b1a41e11774b980915c72 | Triage

Analysis

max time kernel
121s
max time network
129s
platform
windows10_x64
resource
win10-en-20211208
submitted
13-12-2021 15:17

Sharing

Report Analysis Logs

General

Target

DHL_119040 документ о получении,doc.exe
Size

756KB
MD5

3b62d1c0b3151a63ebc779d8723596f3
SHA1

865a6e4b1e90b8d4d8e27f13b6795df84267b70c
SHA256

10f5584682c3f5d54ba1e3afd68822c81e8234531c8b1a41e11774b980915c72
SHA512

85d36bf7f352e0d9dd39b5f9646b977dbdbe44bae176a07f78ca4cf1323121fdba68fbb9e8e3d4d90ed9803bc0a66ec9641714d8f9d58a9282c4f7b014e7ca0a

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4156-115-0x0000000002B71000-0x0000000002B85000-memory.dmp	modiloader_stage1

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3140 4156 WerFault.exe DHL_119040 документ о получении,doc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe
3140	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3140 WerFault.exe
Token: SeBackupPrivilege 3140 WerFault.exe
Token: SeDebugPrivilege 3140 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL_119040 документ о получении,doc.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_119040 документ о получении,doc.exe"
1⤵
PID:4156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 1096
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-115-0x0000000002B71000-0x0000000002B85000-memory.dmp

Filesize
80KB

Download
memory/4156-116-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download