modiloader | 0154435a9ca1ab793fb98c95b9fc1cef9b64cb6e54e7b0af6cc358018476ee11

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order confirmation reference no. FXEPS62022.exe
Size

662KB
MD5

143bcb812ed5583a70d2a5c425ed0b81
SHA1

09f4a1032067ec2c4c12206b67f4348fa8fc8432
SHA256

0154435a9ca1ab793fb98c95b9fc1cef9b64cb6e54e7b0af6cc358018476ee11
SHA512

0f7c552d17e9e0e6a9cacffaa9492d21e651e34ab80b52dc397b96827030fb9a64bd00ff791b6a4b722b3d82f8faa4797d0b225cbb0781f18adf974888935383
SSDEEP

12288:xDjeLlJcFNDJJCTbtCkQHvGMJfGb8/4OQk5dHj8h:xDiT6pyJmGMJfGw/LQk38h

Score

10^/10

modiloader warzonerat infostealer persistence rat trojan

Malware Config

Extracted

Family

warzonerat

bestsuccess.ddns.net:2442

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4788-132-0x00000000027E0000-0x000000000280B000-memory.dmp	modiloader_stage2

Warzone RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3420-135-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3420-137-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3420-138-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3420-139-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Order confirmation reference no. FXEPS62022.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hxudnnjp = "C:\\Users\\Public\\Libraries\\pjnnduxH.url"	Order confirmation reference no. FXEPS62022.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Order confirmation reference no. FXEPS62022.exe

description	pid	process	target process
PID 4788 set thread context of 3420	4788	Order confirmation reference no. FXEPS62022.exe	Order confirmation reference no. FXEPS62022.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Order confirmation reference no. FXEPS62022.exe

description	pid	process	target process
PID 4788 wrote to memory of 3420	4788	Order confirmation reference no. FXEPS62022.exe	Order confirmation reference no. FXEPS62022.exe
PID 4788 wrote to memory of 3420	4788	Order confirmation reference no. FXEPS62022.exe	Order confirmation reference no. FXEPS62022.exe
PID 4788 wrote to memory of 3420	4788	Order confirmation reference no. FXEPS62022.exe	Order confirmation reference no. FXEPS62022.exe
PID 4788 wrote to memory of 3420	4788	Order confirmation reference no. FXEPS62022.exe	Order confirmation reference no. FXEPS62022.exe

C:\Users\Admin\AppData\Local\Temp\Order confirmation reference no. FXEPS62022.exe
"C:\Users\Admin\AppData\Local\Temp\Order confirmation reference no. FXEPS62022.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4788

C:\Users\Admin\AppData\Local\Temp\Order confirmation reference no. FXEPS62022.exe
"C:\Users\Admin\AppData\Local\Temp\Order confirmation reference no. FXEPS62022.exe"
2⤵
PID:3420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3420-134-0x0000000000000000-mapping.dmp

Download
memory/3420-135-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3420-137-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3420-138-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3420-139-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4788-132-0x00000000027E0000-0x000000000280B000-memory.dmp

Filesize
172KB

Download