modiloader | 6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba

General

Target

6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe
Size

1.6MB
MD5

189d808e63b0cab773bf93e2d223aa1e
SHA1

ba8ae355509c8c73cd53e32d09f3b756a9876884
SHA256

6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba
SHA512

5cd92c6f1675b6ecafc8cb713625aeca66576b368cadb186c95f283e676b1bda8e328c1d40d307e7049280b47d831413d5153cefb55b6096012c59af564e3642

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Cache.exe	modiloader_stage2
C:\Users\Admin\AppData\Local\Cache.exe	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

Cache.exe

pid process

4060 Cache.exe

pid	process
4060	Cache.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ctfmon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rzfiot = "C:\\Users\\Admin\\AppData\\Local\\rzfiot\\rzfiot.vbs"	ctfmon.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ctfmon.exe

description pid process target process

PID 1408 set thread context of 3104 1408 ctfmon.exe logagent.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

844 3104 WerFault.exe logagent.exe

description	pid	process	target process
PID 1408 set thread context of 3104	1408	ctfmon.exe	logagent.exe

pid	pid_target	process	target process
844	3104	WerFault.exe	logagent.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exeCache.exe

description	pid	process	target process
PID 4380 wrote to memory of 4060	4380	6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe	Cache.exe
PID 4380 wrote to memory of 4060	4380	6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe	Cache.exe
PID 4380 wrote to memory of 4060	4380	6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe	Cache.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe
PID 4060 wrote to memory of 1408	4060	Cache.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe
"C:\Users\Admin\AppData\Local\Temp\6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4380

C:\Users\Admin\AppData\Local\Cache.exe
C:\Users\Admin\AppData\Local\Cache.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\ctfmon.exe
ctfmon.exe
3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1408

C:\Windows\SysWOW64\logagent.exe
logagent.exe
4⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 80
5⤵
- Program crash
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3104 -ip 3104
1⤵
PID:1956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Cache.exe
Filesize
413KB

MD5
c6db6ae46411c10036f472634524d56e

SHA1
edea43634f29770ae45806a3784c92d936cb39d0

SHA256
5d383909ae9cb8cd0cd947c6dd7c1b4efa4c6ee390ac205c796ee659c7846261

SHA512
b898f47b688f51f36ef6eb49b9d84abcac7c72beacf5eba61a53f8d1e9173bf3180917538826fac52bcecedf075fe56052f0f5658b757048f8e957eb675c54ec

Download Submit
C:\Users\Admin\AppData\Local\Cache.exe
Filesize
413KB

MD5
c6db6ae46411c10036f472634524d56e

SHA1
edea43634f29770ae45806a3784c92d936cb39d0

SHA256
5d383909ae9cb8cd0cd947c6dd7c1b4efa4c6ee390ac205c796ee659c7846261

SHA512
b898f47b688f51f36ef6eb49b9d84abcac7c72beacf5eba61a53f8d1e9173bf3180917538826fac52bcecedf075fe56052f0f5658b757048f8e957eb675c54ec

Download Submit
C:\Users\Admin\AppData\Local\Tm.bmp
Filesize
690KB

MD5
b18c102b88890dec91896b5a591bd59d

SHA1
9cd180e2d83f72013d4be79dc0f59abbb33ec159

SHA256
fabc7103396904bd7d967c81ffea1218c1cc7adf5bc33d7ff29fdcbc206bb0f2

SHA512
14a1fe14b825cd7c8bf230a6aeb5bc74d9738ab2cbe715e8dcd0056a12a19184c0b636f80d699d465989372b0dbcd1a3905a49c218dd96170c79a09c2f4567d1

Download Submit
memory/1408-149-0x0000000020010000-0x00000000200A0000-memory.dmp

Filesize
576KB

Download
memory/1408-146-0x0000000020010000-0x00000000200A0000-memory.dmp

Filesize
576KB

Download
memory/1408-139-0x0000000000000000-mapping.dmp

Download
memory/3104-147-0x0000000000000000-mapping.dmp

Download
memory/4060-140-0x0000000020010000-0x00000000200A0000-memory.dmp

Filesize
576KB

Download
memory/4060-133-0x0000000000000000-mapping.dmp

Download
memory/4380-136-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/4380-130-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/4380-132-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/4380-131-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads