modiloader | b90122d45b3e426cdf4343cc47fd486e67d4d2fe861f6a686f4d29919a327ed3

Analysis

max time kernel
4294178s
max time network
122s
platform
windows7_x64
resource
win7-20220311-en
submitted
01/04/2022, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HBL - TPLINNYC20220211 - ZET MFG -.exe
Size 939KB
Sample220401-kyc17adfbr
SHA256 b90122d45b3e426cdf4343cc47fd486e67d4d2fe861f6a686f4d29919a327ed3
MD5 3b94fdc5e66e0366ea3fe045413e27d3
SHA1 8895637c0016e15baa66a60d0066a81c38a09213
SHA512 031e8977655d3120b23800c43b53d5133b5efa9ab2fa5913d7662c7fa5e2723db08ca10b4981f73b9451b93b8aa212a7f28e6be633b97b395bc3a004ff6c419e
MD5 SHA1 SHA512

Score

10^/10

modiloader xloader k9so loader persistence rat trojan

Malware Config

Extracted

Family

xloader

Version

Campaign

k9so

Decoy

unconsulted.com
videomuncher.com
ktntwin.xyz
mgm-photography.com
ruzgardent.com
etfc.email
coincamo89.com
thenicolerussell.com
phuquocnightlife.com
rosanamunozfisioterapia.com
a2siaruj2.xyz
pedorc.com
auto-hybrid.info
9dzz.com
casinopiscinealey.com
visualcleanx.com
melisavera.com
onlineb5d2.com
drsharonslanguagecourses.mobi
cryptoregulation.xyz
cantokilograms.space
aedomain.xyz
floridaefilingportal.com
yesidoitalia.com
angeltaxi.net
bshizz.com
901yna.com
tksgourmet.com
boredhorns.com
yousafbservices.com
custommortgagefunding.com
st666.red
bluecrosscalifornia.com
timexc.xyz
samuelelivya.com
melvinonthemic.com
academyofmissionrenewal.com
protopathy.info
lliao.net
huididianshang.com
tryput.com
scgxjp.com
swiss-tobe.com
sayangki.com
joyville-shapoorjipallonji.com
princessbridal15.com
deluxehomeservices.biz
first-fair.com
ernestograjalesjr.com
attention.global
yfarm.club
tankheadmuaythai.com
surflander.com
theraicesleeves-hotdeals.com
moldluck.com
precisalogistica.com
yolopartyboat.com
prisonerofbeauty.com
whereisthischipotle.com
cayetta.com
notarypublicmobile305.com
ben-nall.com
wagersonpost.com
froptuio.website
simplesbrand.com

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1984-62-0x0000000000000000-mapping.dmp	xloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xhlrudk = "C:\\Users\\Public\\Libraries\\kdurlhX.url"	HBL - TPLINNYC20220211 - ZET MFG -.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1160	1984	WerFault.exe	29

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	HBL - TPLINNYC20220211 - ZET MFG -.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	HBL - TPLINNYC20220211 - ZET MFG -.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	HBL - TPLINNYC20220211 - ZET MFG -.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	HBL - TPLINNYC20220211 - ZET MFG -.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1476	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1984	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	29
PID 1860 wrote to memory of 1984	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	29
PID 1860 wrote to memory of 1984	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	29
PID 1860 wrote to memory of 1984	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	29
PID 1860 wrote to memory of 1984	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	29
PID 1860 wrote to memory of 1984	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	29
PID 1860 wrote to memory of 1984	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	29
PID 1860 wrote to memory of 1156	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	31
PID 1860 wrote to memory of 1156	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	31
PID 1860 wrote to memory of 1156	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	31
PID 1860 wrote to memory of 1156	1860	HBL - TPLINNYC20220211 - ZET MFG -.exe	31
PID 1984 wrote to memory of 1160	1984	logagent.exe	32
PID 1984 wrote to memory of 1160	1984	logagent.exe	32
PID 1984 wrote to memory of 1160	1984	logagent.exe	32
PID 1984 wrote to memory of 1160	1984	logagent.exe	32
PID 1156 wrote to memory of 1808	1156	cmd.exe	33
PID 1156 wrote to memory of 1808	1156	cmd.exe	33
PID 1156 wrote to memory of 1808	1156	cmd.exe	33
PID 1156 wrote to memory of 1808	1156	cmd.exe	33
PID 1808 wrote to memory of 1700	1808	cmd.exe	35
PID 1808 wrote to memory of 1700	1808	cmd.exe	35
PID 1808 wrote to memory of 1700	1808	cmd.exe	35
PID 1808 wrote to memory of 1700	1808	cmd.exe	35
PID 1700 wrote to memory of 1064	1700	net.exe	36
PID 1700 wrote to memory of 1064	1700	net.exe	36
PID 1700 wrote to memory of 1064	1700	net.exe	36
PID 1700 wrote to memory of 1064	1700	net.exe	36
PID 1808 wrote to memory of 1476	1808	cmd.exe	37
PID 1808 wrote to memory of 1476	1808	cmd.exe	37
PID 1808 wrote to memory of 1476	1808	cmd.exe	37
PID 1808 wrote to memory of 1476	1808	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\HBL - TPLINNYC20220211 - ZET MFG -.exe
"C:\Users\Admin\AppData\Local\Temp\HBL - TPLINNYC20220211 - ZET MFG -.exe"
1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 140
    3⤵
    - Program crash
    PID:1160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Public\Libraries\Xhlrudkt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\XhlrudkO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1064
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cdex.bat

Path C:\Users\Public\Libraries\Cdex.bat
Size 155B
SHA256 37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
MD5 213c60adf1c9ef88dc3c9b2d579959d2
SHA1 e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA512 fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
MD5 SHA1 SHA512

Submit Download

XhlrudkO.bat

Path C:\Users\Public\Libraries\XhlrudkO.bat
Size 1KB
SHA256 4ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
MD5 df48c09f243ebcc8a165f77a1c2bf889
SHA1 455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA512 735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
MD5 SHA1 SHA512

Submit Download

Xhlrudkt.bat

Path C:\Users\Public\Libraries\Xhlrudkt.bat
Size 56B
SHA256 658022239ce83b38665015677e6d8e0669b8876b74976ab2ad79d827debe9055
MD5 470998cf83c1162435e60ffd16d6e2c2
SHA1 c25f2be7125364324ca9c01aa3158ebeba1d5684
SHA512 4d354e4ea35b42fee33800e8e1c04e8c847e105775774121be081b618e391750664b76ebf0815ff85ad21f85c8546af59d61190b01e8ca5385e95fe4ef801b0c
MD5 SHA1 SHA512

Submit Download

memory/1476-73-0x0000000072400000-0x00000000729AB000-memory.dmp

Download

memory/1476-74-0x00000000026C2000-0x00000000026C4000-memory.dmp

Download

memory/1860-54-0x0000000075E61000-0x0000000075E63000-memory.dmp

Download

memory/1984-58-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1984-56-0x0000000010410000-0x0000000010439000-memory.dmp

Download