modiloader | b931f34008a112398ad48f0bd4e2e955dd7385bcc5cafd41cdb2220f26bddc44

General

Target

f23cee6cf6de2de9b3d570a7f017c22b.exe
Size

1.0MB
MD5

f23cee6cf6de2de9b3d570a7f017c22b
SHA1

12b26e966bdb8e29734597d210c54d19509dbff8
SHA256

b931f34008a112398ad48f0bd4e2e955dd7385bcc5cafd41cdb2220f26bddc44
SHA512

56465532903563e248ccfe2ffdee198e1b967b65d99f7c977bb7e65e84330acc1273afcb119b55c147ebb22a0588e8855e604d0a54c335096efb265308f18586

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f23cee6cf6de2de9b3d570a7f017c22b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zmhuuiu = "C:\\Users\\Public\\Libraries\\uiuuhmZ.url"	f23cee6cf6de2de9b3d570a7f017c22b.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1444 1556 WerFault.exe DpiScaling.exe

pid	pid_target	process	target process
1444	1556	WerFault.exe	DpiScaling.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f23cee6cf6de2de9b3d570a7f017c22b.exeDpiScaling.exe

description	pid	process	target process
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 2008 wrote to memory of 1556	2008	f23cee6cf6de2de9b3d570a7f017c22b.exe	DpiScaling.exe
PID 1556 wrote to memory of 1444	1556	DpiScaling.exe	WerFault.exe
PID 1556 wrote to memory of 1444	1556	DpiScaling.exe	WerFault.exe
PID 1556 wrote to memory of 1444	1556	DpiScaling.exe	WerFault.exe
PID 1556 wrote to memory of 1444	1556	DpiScaling.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f23cee6cf6de2de9b3d570a7f017c22b.exe
"C:\Users\Admin\AppData\Local\Temp\f23cee6cf6de2de9b3d570a7f017c22b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\DpiScaling.exe
C:\Windows\System32\DpiScaling.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 152
3⤵
- Program crash
PID:1444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-89-0x0000000000000000-mapping.dmp

Download
memory/1556-63-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1556-65-0x0000000000000000-mapping.dmp

Download
memory/1556-83-0x0000000010670000-0x00000000107C6000-memory.dmp

Filesize
1.3MB

Download
memory/2008-54-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing