modiloader | 926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c

General

Target

926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe
Size

1.0MB
MD5

accf119512ef395778488003900d8226
SHA1

ba0eff961e9e43ac35a837dd43fcbab2a554d04b
SHA256

926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c
SHA512

f9fca6f256884a2544fe1f580c6656296c424bf6947acf8c91235d33571e749f8857683917d2196728b9a5bff7817c39926368c26bdc2aaa40cdaab167bb7005

Score

10^/10

modiloader persistence trojan

Malware Config

Extracted

Family

modiloader

C2

https://cdn.discordapp.com/attachments/734633826718056471/771632517647695902/Rebxeee

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2868-132-0x0000000004680000-0x0000000004690000-memory.dmp	modiloader_stage1
behavioral2/memory/2868-139-0x0000000004B40000-0x0000000004B50000-memory.dmp	modiloader_stage1

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rebx = "C:\\Users\\Admin\\AppData\\Local\\xbeR.url"	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

4428 reg.exe
3320 reg.exe
3508 reg.exe

pid	process
4428	reg.exe
3320	reg.exe
3508	reg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe

description	pid	process	target process
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe
PID 2868 wrote to memory of 4464	2868	926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe	Notepad.exe

C:\Users\Admin\AppData\Local\Temp\926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe
"C:\Users\Admin\AppData\Local\Temp\926a1d29e97f80aa65deb0186c1174d85db2236997e4eba91aac0592ff2c077c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\Notepad.exe
  "C:\Windows\System32\Notepad.exe"
  2⤵
  PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat
    3⤵
    PID:1996
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:4428
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:3320
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:3896
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat
    3⤵
    PID:1356
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  PID:3840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Natso.bat

Filesize
283B

MD5
5cc1682955fd9f5800a8f1530c9a4334

SHA1
e09b6a4d729f2f4760ee42520ec30c3192c85548

SHA256
5562cc607d2f698327efacc4a21bd079bb14a99b03e7a01b3c67f8440e341cb3

SHA512
80767263aad44c739236161d4338d5dd8b0b58613f22cd173c3e88ebf143220ee56bbf93ace69a07d3c2f00daff0adbaa8461a1d53d12699725395c931c43cb6

Download Submit
memory/1356-154-0x0000000000000000-mapping.dmp

Download
memory/1996-146-0x0000000000000000-mapping.dmp

Download
memory/2868-132-0x0000000004680000-0x0000000004690000-memory.dmp

Filesize
64KB

Download
memory/2868-139-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/3320-149-0x0000000000000000-mapping.dmp

Download
memory/3508-151-0x0000000000000000-mapping.dmp

Download
memory/3840-153-0x0000000000000000-mapping.dmp

Download
memory/3896-150-0x0000000000000000-mapping.dmp

Download
memory/4428-148-0x0000000000000000-mapping.dmp

Download
memory/4464-145-0x0000000000000000-mapping.dmp

Download
memory/4464-152-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads