modiloader | 1521b3679443397b8a953666ff6e81b4650a4c3e731bd0ae5c057a29cd238332

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
25/03/2022, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
from-isoPPPFORG.EXE1.exe
Size 1.0MB
Sample220325-svsapshed4
SHA256 1521b3679443397b8a953666ff6e81b4650a4c3e731bd0ae5c057a29cd238332
MD5 ac7a344d191e79cf03326dcdab958a4b
SHA1 061154e116643ba1402d00b3cb1d83253e440773
SHA512 25eaf4da6d2ddfb0a4776dc6096daa2a49a3626cf05a368480ee2199bf63921ec69e712ae3f6a511cb3fb2f2e731ecadf40db2c19e44910dcfa4f7667426b888
MD5 SHA1 SHA512

Score

10^/10

modiloader netwire botnet persistence rat stealer trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/5092-133-0x0000000010560000-0x00000000105A7000-memory.dmp	netwire
behavioral2/memory/5092-134-0x0000000000CD0000-0x0000000000D14000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1996-131-0x0000000003FD1000-0x0000000003FF7000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uiemwoj = "C:\\Users\\Public\\jowmeiU.url"	from-isoPPPFORG.EXE1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1588	5092	WerFault.exe	88

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88
PID 1996 wrote to memory of 5092	1996	from-isoPPPFORG.EXE1.exe	88

C:\Users\Admin\AppData\Local\Temp\from-isoPPPFORG.EXE1.exe
"C:\Users\Admin\AppData\Local\Temp\from-isoPPPFORG.EXE1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\DpiScaling.exe
  C:\Windows\System32\DpiScaling.exe
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 428
    3⤵
    - Program crash
    PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 5092 -ip 5092
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-131-0x0000000003FD1000-0x0000000003FF7000-memory.dmp

Download

memory/5092-133-0x0000000010560000-0x00000000105A7000-memory.dmp

Download

memory/5092-134-0x0000000000CD0000-0x0000000000D14000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads