modiloader | c2b2e774a10f9b1de9375018b051a0a898bf90065d49a0d716de4bcfefd9abe5

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2022 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Requisition ,,xp.exe
Size

626KB
MD5

1dd6591858428a58b81dfbd26507cf87
SHA1

157fdf999bfa380e886d442f25eddea3e26eca04
SHA256

c2b2e774a10f9b1de9375018b051a0a898bf90065d49a0d716de4bcfefd9abe5
SHA512

30ad1d64cc494b3ac29f987e9c1c5a2b1ac6aba2215b92df3fa10a8c933a56a4289518a5380c04b15d88242c1d73016a7b5c52c68e5cfe9e767647725db2865a

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Requisition ,,xp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wlzwzeyeh = "C:\\Users\\Public\\Libraries\\heyezwzlW.url"	Requisition ,,xp.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3704 3716 WerFault.exe Requisition ,,xp.exe

pid	pid_target	process	target process
3704	3716	WerFault.exe	Requisition ,,xp.exe

C:\Users\Admin\AppData\Local\Temp\Requisition ,,xp.exe
"C:\Users\Admin\AppData\Local\Temp\Requisition ,,xp.exe"
1⤵
- Adds Run key to start application
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 2020
2⤵
- Program crash
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3716 -ip 3716
1⤵
PID:2352

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads