modiloader | bdbae233809182b9302bbd8701a1919dff782e16cd1c96de1a880f93fbeed86d

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
11/04/2022, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe
Size 899KB
Sample220411-hlxtqaebf9
SHA256 bdbae233809182b9302bbd8701a1919dff782e16cd1c96de1a880f93fbeed86d
MD5 0a0ba6607582f2de98d12d694bf866e1
SHA1 4715884ec9fee63cdfa39f7ab59153f222c62726
SHA512 834cf4b66903abd5880203c9f36a8c615cf5af1c1fae2ce6eed0208458b4063b5f4528e835d762dbf70e33583e88ccfe881afd5a06cd15b4aaf965c70f0fddca
MD5 SHA1 SHA512

Score

10^/10

modiloader netwire botnet persistence rat stealer trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3240-158-0x0000000010550000-0x0000000010585000-memory.dmp	netwire
behavioral2/memory/3240-159-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kqhkwop = "C:\\Users\\Public\\Libraries\\powkhqK.url"	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DpiScaling.exe	DpiScaling.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3200	powershell.exe
3200	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3764	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	89
PID 4408 wrote to memory of 3764	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	89
PID 4408 wrote to memory of 3764	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	89
PID 3764 wrote to memory of 4804	3764	cmd.exe	91
PID 3764 wrote to memory of 4804	3764	cmd.exe	91
PID 3764 wrote to memory of 4804	3764	cmd.exe	91
PID 4804 wrote to memory of 3944	4804	cmd.exe	93
PID 4804 wrote to memory of 3944	4804	cmd.exe	93
PID 4804 wrote to memory of 3944	4804	cmd.exe	93
PID 3944 wrote to memory of 3888	3944	net.exe	94
PID 3944 wrote to memory of 3888	3944	net.exe	94
PID 3944 wrote to memory of 3888	3944	net.exe	94
PID 4804 wrote to memory of 3200	4804	cmd.exe	95
PID 4804 wrote to memory of 3200	4804	cmd.exe	95
PID 4804 wrote to memory of 3200	4804	cmd.exe	95
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103
PID 4408 wrote to memory of 3240	4408	Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe	103

C:\Users\Admin\AppData\Local\Temp\Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe
"C:\Users\Admin\AppData\Local\Temp\Kqhkwopkgicygibvzwbrovstxhfzdguszk.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\Kqhkwopt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\KqhkwopO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3200
- C:\Windows\SysWOW64\DpiScaling.exe
  C:\Windows\System32\DpiScaling.exe
  2⤵
  - Drops file in System32 directory
  PID:3240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cdex.bat

Path C:\Users\Public\Libraries\Cdex.bat
Size 155B
SHA256 37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
MD5 213c60adf1c9ef88dc3c9b2d579959d2
SHA1 e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA512 fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
MD5 SHA1 SHA512

Submit Download

KqhkwopO.bat

Path C:\Users\Public\Libraries\KqhkwopO.bat
Size 1KB
SHA256 4ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
MD5 df48c09f243ebcc8a165f77a1c2bf889
SHA1 455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA512 735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
MD5 SHA1 SHA512

Submit Download

Kqhkwopt.bat

Path C:\Users\Public\Libraries\Kqhkwopt.bat
Size 56B
SHA256 2a7138d9eb5f6557ebaa95ca57f0a38608a8f5c57fbf7b6748d28d7b1cfa5be3
MD5 6756a3d67a471264038642498378b45e
SHA1 92681ed5b0b865655119944a44ccce79d5ca6b0a
SHA512 ff3fcef906617c2ac24d55933af2c1bccc59e503349628e71f3fc59e042a4f7ae31cc7d916a47fca0e94686e7803dff6c07544d83996aea7acd46de6eece55c7
MD5 SHA1 SHA512

Submit Download

memory/3200-146-0x00000000069D0000-0x0000000006A02000-memory.dmp

Download

memory/3200-148-0x0000000006970000-0x000000000698E000-memory.dmp

Download

memory/3200-156-0x0000000007A10000-0x0000000007A18000-memory.dmp

Download

memory/3200-155-0x0000000007A20000-0x0000000007A3A000-memory.dmp

Download

memory/3200-140-0x0000000002F30000-0x0000000002F66000-memory.dmp

Download

memory/3200-141-0x00000000057B0000-0x0000000005DD8000-memory.dmp

Download

memory/3200-142-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/3200-143-0x0000000005720000-0x0000000005786000-memory.dmp

Download

memory/3200-144-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Download

memory/3200-145-0x0000000006410000-0x000000000642E000-memory.dmp

Download

memory/3200-154-0x0000000007920000-0x000000000792E000-memory.dmp

Download

memory/3200-147-0x000000006F900000-0x000000006F94C000-memory.dmp

Download

memory/3200-153-0x0000000007960000-0x00000000079F6000-memory.dmp

Download

memory/3200-149-0x0000000007D30000-0x00000000083AA000-memory.dmp

Download

memory/3200-150-0x00000000076F0000-0x000000000770A000-memory.dmp

Download

memory/3200-151-0x0000000005175000-0x0000000005177000-memory.dmp

Download

memory/3200-152-0x0000000007770000-0x000000000777A000-memory.dmp

Download

memory/3240-158-0x0000000010550000-0x0000000010585000-memory.dmp

Download

memory/3240-159-0x0000000000400000-0x0000000000433000-memory.dmp

Download