modiloader | 83d7062a6e44aed6a161da23937cc66f97982e045d933dc4dd2049df4496d34b

Analysis

max time kernel
47s
max time network
114s
platform
windows7_x64
resource
win7-20220331-en
submitted
13/04/2022, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Attachment.exe
Size 645KB
Sample220413-wp954seddj
SHA256 83d7062a6e44aed6a161da23937cc66f97982e045d933dc4dd2049df4496d34b
MD5 6bb736bd3a18cb0a31e37e2922517e4e
SHA1 a9066b9266b3fa065fd73e7fbe2d71d073e1ccb8
SHA512 2af71bb8fbc10742e89ce2240ad28ee5ef2004c8713c663fe60fefe79e3039b14ea0fe545dc0a1c99d2961b47975459a5fb9b694f48a01b89062137e2785805f
MD5 SHA1 SHA512

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bkungwd = "C:\\Users\\Public\\Libraries\\dwgnukB.url"	Attachment.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	1376	WerFault.exe	38

Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
588	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	588	powershell.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1452	1720	Attachment.exe	30
PID 1720 wrote to memory of 1452	1720	Attachment.exe	30
PID 1720 wrote to memory of 1452	1720	Attachment.exe	30
PID 1720 wrote to memory of 1452	1720	Attachment.exe	30
PID 1452 wrote to memory of 1264	1452	cmd.exe	32
PID 1452 wrote to memory of 1264	1452	cmd.exe	32
PID 1452 wrote to memory of 1264	1452	cmd.exe	32
PID 1452 wrote to memory of 1264	1452	cmd.exe	32
PID 1264 wrote to memory of 704	1264	cmd.exe	34
PID 1264 wrote to memory of 704	1264	cmd.exe	34
PID 1264 wrote to memory of 704	1264	cmd.exe	34
PID 1264 wrote to memory of 704	1264	cmd.exe	34
PID 704 wrote to memory of 828	704	net.exe	35
PID 704 wrote to memory of 828	704	net.exe	35
PID 704 wrote to memory of 828	704	net.exe	35
PID 704 wrote to memory of 828	704	net.exe	35
PID 1264 wrote to memory of 588	1264	cmd.exe	36
PID 1264 wrote to memory of 588	1264	cmd.exe	36
PID 1264 wrote to memory of 588	1264	cmd.exe	36
PID 1264 wrote to memory of 588	1264	cmd.exe	36
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1720 wrote to memory of 1376	1720	Attachment.exe	38
PID 1376 wrote to memory of 976	1376	logagent.exe	39
PID 1376 wrote to memory of 976	1376	logagent.exe	39
PID 1376 wrote to memory of 976	1376	logagent.exe	39
PID 1376 wrote to memory of 976	1376	logagent.exe	39

C:\Users\Admin\AppData\Local\Temp\Attachment.exe
"C:\Users\Admin\AppData\Local\Temp\Attachment.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Public\Libraries\Bkungwdt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\BkungwdO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:828
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:588
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 144
    3⤵
    - Program crash
    PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BkungwdO.bat

Path C:\Users\Public\Libraries\BkungwdO.bat
Size 1KB
SHA256 4ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
MD5 df48c09f243ebcc8a165f77a1c2bf889
SHA1 455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA512 735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
MD5 SHA1 SHA512

Submit Download

Bkungwdt.bat

Path C:\Users\Public\Libraries\Bkungwdt.bat
Size 56B
SHA256 b2470bbd9ea785199aaaf07568db25094012822f2f998b27a103cbb0b3771706
MD5 cba438d34dc6c2971a89a1cae7de40d0
SHA1 0e1db795f427455f9dcc4e33e0f3bd2cdf766b99
SHA512 0c2639041845339d42964d3c50f340d0f7b288f094093daccb8c2bbaf1f00528a412262870076dcd6b901ca07e64eac4958b5bbd807a3b9de0d2ecdb9cfe87c2
MD5 SHA1 SHA512

Submit Download

Cdex.bat

Path C:\Users\Public\Libraries\Cdex.bat
Size 155B
SHA256 37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
MD5 213c60adf1c9ef88dc3c9b2d579959d2
SHA1 e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA512 fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
MD5 SHA1 SHA512

Submit Download

memory/588-73-0x00000000025C0000-0x000000000320A000-memory.dmp

Download

memory/588-72-0x0000000073B70000-0x000000007411B000-memory.dmp

Download

memory/1376-74-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1376-93-0x0000000010560000-0x00000000105A7000-memory.dmp

Download

memory/1720-54-0x0000000075941000-0x0000000075943000-memory.dmp

Download