modiloader | 41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7

General

Target

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
Size

284KB
MD5

71096df07cffaf2eca61f769660708b0
SHA1

1dc9cb4d2e512bf9c6e665a55abc92b3d3d4a598
SHA256

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7
SHA512

0660d8ef78c19d1793e4882300b7c987d46832794734563e91bcc5b828d86c68aeaff59898451c892b58836ac9b999b11e99701aff77f782756b1eb8b620d350
SSDEEP

6144:Aen7pmZX/JaVjUsvvEVtXk07pGm2WCg8zQMrqnvwPzB/mLUacmV:XdmC1LEf00QzWnGQNn4PzPat

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 308 1264 mshta.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	1264	mshta.exe

ModiLoader Second Stage 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5052-134-0x0000000000400000-0x0000000001400000-memory.dmp	modiloader_stage2
behavioral2/memory/5052-136-0x0000000000400000-0x0000000001400000-memory.dmp	modiloader_stage2
behavioral2/memory/5052-137-0x0000000000400000-0x0000000000435000-memory.dmp	modiloader_stage2
behavioral2/memory/5052-138-0x000000000D590000-0x000000000D650000-memory.dmp	modiloader_stage2
behavioral2/memory/5052-142-0x000000000D590000-0x000000000D650000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

mshta.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mshta.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	mshta.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe

description	pid	process	target process
PID 4920 set thread context of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\International\CpMRU	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	mshta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Cache = b104000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mshta.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exepowershell.exe

pid	process
4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
3916	powershell.exe
3916	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3916 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe

pid process

4920 41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe

description	pid	process
Token: SeDebugPrivilege	3916	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exemshta.exe

description	pid	process	target process
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 4920 wrote to memory of 5052	4920	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe	41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
PID 308 wrote to memory of 3916	308	mshta.exe	powershell.exe
PID 308 wrote to memory of 3916	308	mshta.exe	powershell.exe
PID 308 wrote to memory of 3916	308	mshta.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
"C:\Users\Admin\AppData\Local\Temp\41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920

C:\Users\Admin\AppData\Local\Temp\41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe
"C:\Users\Admin\AppData\Local\Temp\41a0f10d4906edfada07b2ad57fba77c5f664bc40e09c88879793654206900f7.exe"
2⤵
PID:5052

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:G0MCgrdM="2";X25w=new%20ActiveXObject("WScript.Shell");oX2PHr8uLz="GGuAB";ELUz2=X25w.RegRead("HKLM\\software\\Wow6432Node\\VtERheagv\\1ftWJePji");J6GQFbbT1="2DZ";eval(ELUz2);Acw8bBI0K="r6";
1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:cawse
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3916-144-0x0000000004E40000-0x0000000004E62000-memory.dmp

Filesize
136KB

Download
memory/3916-149-0x0000000006CF0000-0x0000000006D0A000-memory.dmp

Filesize
104KB

Download
memory/3916-148-0x0000000007350000-0x00000000079CA000-memory.dmp

Filesize
6.5MB

Download
memory/3916-147-0x0000000005680000-0x000000000569E000-memory.dmp

Filesize
120KB

Download
memory/3916-146-0x0000000005730000-0x0000000005796000-memory.dmp

Filesize
408KB

Download
memory/3916-140-0x0000000000000000-mapping.dmp

Download
memory/3916-141-0x00000000024E0000-0x0000000002516000-memory.dmp

Filesize
216KB

Download
memory/3916-145-0x00000000056C0000-0x0000000005726000-memory.dmp

Filesize
408KB

Download
memory/3916-143-0x0000000004EE0000-0x0000000005508000-memory.dmp

Filesize
6.2MB

Download
memory/4920-132-0x0000000000BA0000-0x0000000000BA4000-memory.dmp

Filesize
16KB

Download
memory/5052-137-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5052-142-0x000000000D590000-0x000000000D650000-memory.dmp

Filesize
768KB

Download
memory/5052-138-0x000000000D590000-0x000000000D650000-memory.dmp

Filesize
768KB

Download
memory/5052-136-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/5052-134-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/5052-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads