modiloader | 76389098be8a410aaf6b21297912f6ef745db6e8a2f2aaaddda8685bd91091c3

Resubmissions

31/01/2022, 17:50

220131-wepresbbd210

27/01/2022, 13:45

220127-q2ebbadfbk10

Analysis

max time kernel
133s
max time network
124s
platform
windows7_x64
resource
win7-en-20211208
submitted
31/01/2022, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oxc.exe
Size 664KB
Sample220131-wepresbbd2
SHA256 76389098be8a410aaf6b21297912f6ef745db6e8a2f2aaaddda8685bd91091c3
MD5 1d470425e6e769759432b129e3d1e953
SHA1 092e76ca81792d780c26c7842fd3fc33eb157df9
SHA512 f346784661b69cc72a57d5fb9694c37e947725574f0ac19db5c21c739ca6a718307afb053694859482d282e9d100d2e1bdc19e194cc2380f753502ecb8e0a135
MD5 SHA1 SHA512

Score

10^/10

modiloader warzonerat infostealer persistence rat trojan

Malware Config

Extracted

Family

warzonerat

152.67.253.163:5300

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral1/memory/1968-68-0x0000000004110000-0x0000000004189000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-69-0x0000000004110000-0x0000000004189000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-70-0x0000000004110000-0x0000000004189000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-100-0x0000000004110000-0x0000000004189000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-99-0x0000000004110000-0x0000000004189000-memory.dmp	modiloader_stage2

Warzone RAT Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1832-96-0x0000000001E90000-0x0000000001FE4000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
832	ComputerDefaults.exe
560	ComputerDefaults.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dkmbwcpqlj = "C:\\Users\\Admin\\Contacts\\jlqpcwbmkD.url"	oxc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1920	cmd.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1832	1968	oxc.exe	29
PID 1968 wrote to memory of 1948	1968	oxc.exe	30
PID 1968 wrote to memory of 1948	1968	oxc.exe	30
PID 1968 wrote to memory of 1948	1968	oxc.exe	30
PID 1968 wrote to memory of 1948	1968	oxc.exe	30
PID 1948 wrote to memory of 1920	1948	cmd.exe	32
PID 1948 wrote to memory of 1920	1948	cmd.exe	32
PID 1948 wrote to memory of 1920	1948	cmd.exe	32
PID 1948 wrote to memory of 1920	1948	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\oxc.exe
"C:\Users\Admin\AppData\Local\Temp\oxc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  PID:1832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\Contacts\Dkmbwcpqljt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\Contacts\DkmbwcpqljO.bat
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1920
  - - C:\Windows \System32\ComputerDefaults.exe
      "C:\Windows \System32\ComputerDefaults.exe"
      4⤵
      Executes dropped EXE
      PID:832
  - - C:\Windows \System32\ComputerDefaults.exe
      "C:\Windows \System32\ComputerDefaults.exe"
      4⤵
      Executes dropped EXE
      PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-71-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1832-96-0x0000000001E90000-0x0000000001FE4000-memory.dmp

Download

memory/1832-81-0x00000000726E0000-0x0000000072836000-memory.dmp

Download

memory/1832-92-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1832-95-0x00000000726E0000-0x0000000072836000-memory.dmp

Download

memory/1832-93-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/1832-94-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/1920-98-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/1968-68-0x0000000004110000-0x0000000004189000-memory.dmp

Download

memory/1968-69-0x0000000004110000-0x0000000004189000-memory.dmp

Download

memory/1968-70-0x0000000004110000-0x0000000004189000-memory.dmp

Download

memory/1968-54-0x0000000000320000-0x0000000000321000-memory.dmp

Download

memory/1968-55-0x0000000075431000-0x0000000075433000-memory.dmp

Download

memory/1968-100-0x0000000004110000-0x0000000004189000-memory.dmp

Download

memory/1968-99-0x0000000004110000-0x0000000004189000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads