modiloader | 35cf771ddfdab8d8f18d4ee2b4841602be4bc77f9d952ecd5f9e870160cfe8f8

Analysis

max time kernel
131s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2022, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dad6fc3e297a8fcb86f38ffb94b8d52c.exe
Size 715KB
Sample220809-vf811sdcgn
SHA256 35cf771ddfdab8d8f18d4ee2b4841602be4bc77f9d952ecd5f9e870160cfe8f8
MD5 dad6fc3e297a8fcb86f38ffb94b8d52c
SHA1 a1a86c595cf0a42dfa31badefb797fa5eb80ab91
SHA512 3173cf984a34b13e0c8a5e3b06f42fb0fd4eea2c52757f6f6dc89911cec240360bbf2b6ae054a247a034778879dd4f626da21d4987c7d383444670e7fededbb8
MD5 SHA1 SHA512

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ajdfbdery = "C:\\Users\\Public\\Libraries\\yredbfdjA.url"	dad6fc3e297a8fcb86f38ffb94b8d52c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1112	4748	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\dad6fc3e297a8fcb86f38ffb94b8d52c.exe
"C:\Users\Admin\AppData\Local\Temp\dad6fc3e297a8fcb86f38ffb94b8d52c.exe"
1⤵
- Adds Run key to start application
PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1424
  2⤵
  - Program crash
  PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4748 -ip 4748
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4748-148-0x00000000043E0000-0x00000000044BB000-memory.dmp

Download