modiloader | 63bc8623223491c6337ffed73a4435dd5c5d61576ebb34d465708fdf5d9d9dcd

Analysis

max time kernel
77s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
15/04/2022, 07:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe
Size 759KB
Sample220415-hzd9jadgh9
SHA256 63bc8623223491c6337ffed73a4435dd5c5d61576ebb34d465708fdf5d9d9dcd
MD5 b4fcf0bf44630d22f059667baf5b4564
SHA1 043015ca2c76213a1f1ad6df4b67408aa1246af2
SHA512 2eb2aa6ec5148af5113f83942d29bc33ed1cc9d1f6fd5da14e77803ec585f6781d28e70280f8a04b848fc49deb067cc51f330a8a274287b07f6b72f222021097
MD5 SHA1 SHA512

Score

10^/10

modiloader netwire botnet persistence rat stealer trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3556-164-0x0000000010550000-0x0000000010585000-memory.dmp	netwire
behavioral2/memory/3556-165-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yddkxdu = "C:\\Users\\Public\\Libraries\\udxkddY.url"	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\logagent.exe	logagent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 4480	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	80
PID 4268 wrote to memory of 4480	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	80
PID 4268 wrote to memory of 4480	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	80
PID 4480 wrote to memory of 1408	4480	cmd.exe	82
PID 4480 wrote to memory of 1408	4480	cmd.exe	82
PID 4480 wrote to memory of 1408	4480	cmd.exe	82
PID 1408 wrote to memory of 4148	1408	cmd.exe	84
PID 1408 wrote to memory of 4148	1408	cmd.exe	84
PID 1408 wrote to memory of 4148	1408	cmd.exe	84
PID 4148 wrote to memory of 732	4148	net.exe	85
PID 4148 wrote to memory of 732	4148	net.exe	85
PID 4148 wrote to memory of 732	4148	net.exe	85
PID 1408 wrote to memory of 4868	1408	cmd.exe	86
PID 1408 wrote to memory of 4868	1408	cmd.exe	86
PID 1408 wrote to memory of 4868	1408	cmd.exe	86
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95
PID 4268 wrote to memory of 3556	4268	Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe	95

C:\Users\Admin\AppData\Local\Temp\Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe
"C:\Users\Admin\AppData\Local\Temp\Yddkxdueywhkiefjlsbskdfpfrlwnkzdin.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\Yddkxdut.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\YddkxduO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:732
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4868
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  - Drops file in System32 directory
  PID:3556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cdex.bat

Path C:\Users\Public\Libraries\Cdex.bat
Size 155B
SHA256 37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
MD5 213c60adf1c9ef88dc3c9b2d579959d2
SHA1 e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA512 fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
MD5 SHA1 SHA512

Submit Download

YddkxduO.bat

Path C:\Users\Public\Libraries\YddkxduO.bat
Size 1KB
SHA256 4ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
MD5 df48c09f243ebcc8a165f77a1c2bf889
SHA1 455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA512 735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
MD5 SHA1 SHA512

Submit Download

Yddkxdut.bat

Path C:\Users\Public\Libraries\Yddkxdut.bat
Size 56B
SHA256 2f7d2d4b5054597d7aee9176824b49760e3dee6c5a84b97710463861e1082ff0
MD5 cb7b7ec8abe4c7d52eca22453635960c
SHA1 82599477395a3ab253be79fc16e3fd14809ef28a
SHA512 9d79246677752a30852c1ef78d7d7f1e4dfa19c839194cab01a50ec2fe1858292579b6bbfb1bcf43afc43f94eb521d01080d24f8e87d0e7650906f3cc414ce34
MD5 SHA1 SHA512

Submit Download

memory/3556-165-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3556-164-0x0000000010550000-0x0000000010585000-memory.dmp

Download

memory/4868-152-0x0000000006390000-0x00000000063C2000-memory.dmp

Download

memory/4868-157-0x0000000006FD0000-0x0000000006FEA000-memory.dmp

Download

memory/4868-150-0x00000000057A0000-0x0000000005806000-memory.dmp

Download

memory/4868-151-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

Download

memory/4868-148-0x0000000004EF0000-0x0000000004F12000-memory.dmp

Download

memory/4868-153-0x000000006FED0000-0x000000006FF1C000-memory.dmp

Download

memory/4868-154-0x0000000006320000-0x000000000633E000-memory.dmp

Download

memory/4868-155-0x0000000002955000-0x0000000002957000-memory.dmp

Download

memory/4868-156-0x0000000007750000-0x0000000007DCA000-memory.dmp

Download

memory/4868-149-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/4868-158-0x0000000007110000-0x000000000711A000-memory.dmp

Download

memory/4868-159-0x0000000007300000-0x0000000007396000-memory.dmp

Download

memory/4868-160-0x00000000072C0000-0x00000000072CE000-memory.dmp

Download

memory/4868-161-0x00000000073C0000-0x00000000073DA000-memory.dmp

Download

memory/4868-162-0x00000000073B0000-0x00000000073B8000-memory.dmp

Download

memory/4868-147-0x0000000005020000-0x0000000005648000-memory.dmp

Download

memory/4868-146-0x00000000028D0000-0x0000000002906000-memory.dmp

Download