modiloader | 399068c4de8ddeb1172fcb35d13ba85550b99f322991bdf6e19c911f6436b60d

Analysis

max time kernel
134s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

399068c4de8ddeb1172fcb35d13ba85550b99f322991bdf6e19c911f6436b60d.exe
Size

846KB
MD5

2bba68a7d7b6e50b06aa7254dcb89560
SHA1

ef0fe10dbf1255469cea2ad8bccd7923b9126aea
SHA256

399068c4de8ddeb1172fcb35d13ba85550b99f322991bdf6e19c911f6436b60d
SHA512

38242522f3a084fe548ce93aa4a355c9bc3c6af6dbe4bba45e3e225ee160dbc2a32af784506047de250b6017b84ce962efe7aa59fa3fe14c3d9718525014cb61
SSDEEP

12288:YlH5qK8lRHtbc/8xKmPAKYGLgc1rTQh2wKpdgYWlvCZ1apwuvYe+msnzu8xd:YaxXW/4TPAK1J58hru2zvCZ1izGz

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 56 IoCs

resource	yara_rule
behavioral1/memory/1920-55-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-57-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-58-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-59-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-60-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-61-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-62-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-63-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-64-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-65-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-67-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-66-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-68-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-69-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-71-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-70-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-73-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-72-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-74-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-75-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-77-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-76-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-78-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-79-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-80-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-81-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-82-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-83-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-84-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-86-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-85-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-87-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-88-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-90-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-89-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-91-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-92-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-95-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-94-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-93-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-96-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-99-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-98-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-97-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-100-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-103-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-102-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-101-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-104-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-105-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-106-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-107-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-108-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-109-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-116-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2
behavioral1/memory/1920-110-0x0000000000270000-0x000000000029A000-memory.dmp	modiloader_stage2

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	399068c4de8ddeb1172fcb35d13ba85550b99f322991bdf6e19c911f6436b60d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	399068c4de8ddeb1172fcb35d13ba85550b99f322991bdf6e19c911f6436b60d.exe

C:\Users\Admin\AppData\Local\Temp\399068c4de8ddeb1172fcb35d13ba85550b99f322991bdf6e19c911f6436b60d.exe
"C:\Users\Admin\AppData\Local\Temp\399068c4de8ddeb1172fcb35d13ba85550b99f322991bdf6e19c911f6436b60d.exe"
1⤵
- Modifies system certificate store
PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1920-55-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-57-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-58-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-59-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-60-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-61-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-62-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-63-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-64-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-65-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-67-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-66-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-68-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-69-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-71-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-70-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-73-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-72-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-74-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-75-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-77-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-76-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-78-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-79-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-80-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-81-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-82-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-83-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-84-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-86-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-85-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-87-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-88-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-90-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-89-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-91-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-92-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-95-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-94-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-93-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-96-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-99-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-98-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-97-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-100-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-103-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-102-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-101-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-104-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-105-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-106-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-107-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-108-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-109-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-116-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1920-110-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download