modiloader | 1dddbd9bb1c2ed3b0ac846f3dcfbfd99909394f17a813be425b1870ef0f52c5e

Analysis

max time kernel
124s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2022, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe
Size 715KB
Sample220808-j3b41saad5
SHA256 1dddbd9bb1c2ed3b0ac846f3dcfbfd99909394f17a813be425b1870ef0f52c5e
MD5 39e87adaffb0260e016087a5fb82a1bb
SHA1 b108f80184bfd67c0a330fc6cbe53c72ddc5cd1d
SHA512 1ddae983b8bd8b3d0f812831c9a8bf176d0cc7544dc77284d401d67d40573b2b003351ce09143948db62aa15ed7f3dc504380e5897a54a296adc8b60da892f5f
MD5 SHA1 SHA512

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
39	204	cmd.exe
72	204	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sdvfknogb = "C:\\Users\\Public\\Libraries\\bgonkfvdS.url"	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{85145074-3FD6-458D-A5D5-D42F38C9BCB5}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A8F4CDB0-1076-4F1D-A4E3-E30C88FF9B7C}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2000	powershell.exe
2000	powershell.exe
3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe
3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 2432	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	75
PID 3780 wrote to memory of 2432	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	75
PID 3780 wrote to memory of 2432	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	75
PID 2432 wrote to memory of 2752	2432	cmd.exe	77
PID 2432 wrote to memory of 2752	2432	cmd.exe	77
PID 2432 wrote to memory of 2752	2432	cmd.exe	77
PID 2752 wrote to memory of 1268	2752	cmd.exe	79
PID 2752 wrote to memory of 1268	2752	cmd.exe	79
PID 2752 wrote to memory of 1268	2752	cmd.exe	79
PID 1268 wrote to memory of 1588	1268	net.exe	80
PID 1268 wrote to memory of 1588	1268	net.exe	80
PID 1268 wrote to memory of 1588	1268	net.exe	80
PID 2752 wrote to memory of 2000	2752	cmd.exe	81
PID 2752 wrote to memory of 2000	2752	cmd.exe	81
PID 2752 wrote to memory of 2000	2752	cmd.exe	81
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91
PID 3780 wrote to memory of 204	3780	Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe	91

C:\Users\Admin\AppData\Local\Temp\Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe
"C:\Users\Admin\AppData\Local\Temp\Drawing_0029388827772_Square_General_ContractingDrawing_0029388827772_Square_General_Contracting.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\Sdvfknogbt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\SdvfknogbO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1588
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2000
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k
  2⤵
  - Blocklisted process makes network request
  PID:204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cdex.bat

Path C:\Users\Public\Libraries\Cdex.bat
Size 155B
SHA256 37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
MD5 213c60adf1c9ef88dc3c9b2d579959d2
SHA1 e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA512 fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
MD5 SHA1 SHA512

Submit Download

SdvfknogbO.bat

Path C:\Users\Public\Libraries\SdvfknogbO.bat
Size 1KB
SHA256 4ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
MD5 df48c09f243ebcc8a165f77a1c2bf889
SHA1 455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA512 735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
MD5 SHA1 SHA512

Submit Download

Sdvfknogbt.bat

Path C:\Users\Public\Libraries\Sdvfknogbt.bat
Size 58B
SHA256 a8f4217b6ae29efd35817b6336c05b04f47c52e2adcde6613d9d8fd869c11873
MD5 7f7bf0ee47bbf9454a60ebb94fa9af7c
SHA1 ce416aac19dc890e26d366458af380139b1a807a
SHA512 3ca1bd82de60d7a38346cd2f64ef860c76256ac43fe92595fb6dad0c76e1053b14e5abb93a15d5d71ad1f0a2dbbf3d1001436a97e2e98964048482ae3eb69653
MD5 SHA1 SHA512

Submit Download

memory/204-211-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/204-210-0x0000000050540000-0x000000005056D000-memory.dmp

Download

memory/2000-153-0x0000000006C60000-0x0000000006C92000-memory.dmp

Download

memory/2000-156-0x0000000007440000-0x0000000007ABA000-memory.dmp

Download

memory/2000-149-0x0000000004C20000-0x0000000004C42000-memory.dmp

Download

memory/2000-150-0x0000000005470000-0x00000000054D6000-memory.dmp

Download

memory/2000-151-0x00000000054E0000-0x0000000005546000-memory.dmp

Download

memory/2000-152-0x0000000005AF0000-0x0000000005B0E000-memory.dmp

Download

memory/2000-154-0x000000006F6F0000-0x000000006F73C000-memory.dmp

Download

memory/2000-155-0x0000000006C40000-0x0000000006C5E000-memory.dmp

Download

memory/2000-148-0x0000000004E40000-0x0000000005468000-memory.dmp

Download

memory/2000-157-0x0000000006DF0000-0x0000000006E0A000-memory.dmp

Download

memory/2000-158-0x0000000006E70000-0x0000000006E7A000-memory.dmp

Download

memory/2000-159-0x0000000007060000-0x00000000070F6000-memory.dmp

Download

memory/2000-160-0x0000000007020000-0x000000000702E000-memory.dmp

Download

memory/2000-161-0x0000000007120000-0x000000000713A000-memory.dmp

Download

memory/2000-162-0x0000000007110000-0x0000000007118000-memory.dmp

Download

memory/2000-147-0x0000000002630000-0x0000000002666000-memory.dmp

Download

memory/3780-171-0x0000000050540000-0x000000005056D000-memory.dmp

Download