modiloader | 199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7

General

Target

199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
Size

482KB
MD5

9af8edf2029f46a846751f456ed19c4c
SHA1

44ac0e9da1eedc31a0fcb7feb25c66f7a1305a47
SHA256

199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7
SHA512

592cb88c02fe4fd27daa52bfa3c8f460f764e34e35fd693328dbad08a01f63a37e4d19fb6dc4c50b5ac3b4ca5a18866a6c4f640c5e958ffe0fc7f830f0c81e23
SSDEEP

12288:v6Wq4aaE6KwyF5L0Y2D1PqL4qWxZPYObm4S2BpRzn9lxZr:tthEVaPqL4qWxlNVZfzn9h

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-57-0x00000000000C0000-0x00000000000D1000-memory.dmp	modiloader_stage2
behavioral1/memory/1900-58-0x00000000000C82E8-mapping.dmp	modiloader_stage2
behavioral1/memory/1900-59-0x00000000000C0000-0x00000000000D1000-memory.dmp	modiloader_stage2
behavioral1/memory/1900-62-0x00000000000C0000-0x00000000000D1000-memory.dmp	modiloader_stage2
behavioral1/memory/1900-66-0x00000000000C0000-0x00000000000D1000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-74-0x00000000000C82E8-mapping.dmp	modiloader_stage2
behavioral1/memory/2008-79-0x00000000000C0000-0x00000000000D1000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-80-0x00000000000C0000-0x00000000000D1000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

Processes:

ntdlr.exentdlr.exe

pid process

1916 ntdlr.exe
2008 ntdlr.exe

pid	process
1916	ntdlr.exe
2008	ntdlr.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/364-60-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
\Users\Admin\AppData\Roaming\ntdlr.exe	upx
behavioral1/memory/1900-68-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\ntdlr.exe	upx
C:\Users\Admin\AppData\Roaming\ntdlr.exe	upx
C:\Users\Admin\AppData\Roaming\ntdlr.exe	upx
behavioral1/memory/1916-77-0x0000000000400000-0x00000000004BE000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe

pid process

1900 199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe

pid	process
1900	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ntdlr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Video Driver = "C:\\Users\\Admin\\AppData\\Roaming\\ntdlr.exe"	ntdlr.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/364-60-0x0000000000400000-0x00000000004BE000-memory.dmp	autoit_exe
behavioral1/memory/1916-77-0x0000000000400000-0x00000000004BE000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exentdlr.exe

description	pid	process	target process
PID 364 set thread context of 1900	364	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
PID 1916 set thread context of 2008	1916	ntdlr.exe	ntdlr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exentdlr.exe

description	pid	process	target process
PID 364 wrote to memory of 1900	364	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
PID 364 wrote to memory of 1900	364	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
PID 364 wrote to memory of 1900	364	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
PID 364 wrote to memory of 1900	364	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
PID 364 wrote to memory of 1900	364	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
PID 364 wrote to memory of 1900	364	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
PID 1900 wrote to memory of 1916	1900	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	ntdlr.exe
PID 1900 wrote to memory of 1916	1900	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	ntdlr.exe
PID 1900 wrote to memory of 1916	1900	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	ntdlr.exe
PID 1900 wrote to memory of 1916	1900	199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe	ntdlr.exe
PID 1916 wrote to memory of 2008	1916	ntdlr.exe	ntdlr.exe
PID 1916 wrote to memory of 2008	1916	ntdlr.exe	ntdlr.exe
PID 1916 wrote to memory of 2008	1916	ntdlr.exe	ntdlr.exe
PID 1916 wrote to memory of 2008	1916	ntdlr.exe	ntdlr.exe
PID 1916 wrote to memory of 2008	1916	ntdlr.exe	ntdlr.exe
PID 1916 wrote to memory of 2008	1916	ntdlr.exe	ntdlr.exe

C:\Users\Admin\AppData\Local\Temp\199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
"C:\Users\Admin\AppData\Local\Temp\199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
  C:\Users\Admin\AppData\Local\Temp\199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Users\Admin\AppData\Roaming\ntdlr.exe
    "C:\Users\Admin\AppData\Roaming\ntdlr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Users\Admin\AppData\Roaming\ntdlr.exe
      C:\Users\Admin\AppData\Roaming\ntdlr.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\no.edu

Filesize
36KB

MD5
4d432796933fd2d895c167b7fb1510d3

SHA1
561d62048035603195ab57ad9dffcf111e5491b9

SHA256
c6ffb0880ed82d07dac964e536d40e2d4a6c1064537ea5a764d06d62cb3e5bed

SHA512
be6ad602fafb714ad2ec77158b300753bfde387c036dda47cde40055a8067c36ae94d4711f23ca0677b84cf80bf46ef2b452bd140ac50f7c7ee5209afdd8fca3

Download Submit
C:\Users\Admin\AppData\Roaming\ntdlr.exe

Filesize
482KB

MD5
9af8edf2029f46a846751f456ed19c4c

SHA1
44ac0e9da1eedc31a0fcb7feb25c66f7a1305a47

SHA256
199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7

SHA512
592cb88c02fe4fd27daa52bfa3c8f460f764e34e35fd693328dbad08a01f63a37e4d19fb6dc4c50b5ac3b4ca5a18866a6c4f640c5e958ffe0fc7f830f0c81e23

Download Submit
C:\Users\Admin\AppData\Roaming\ntdlr.exe

Filesize
482KB

MD5
9af8edf2029f46a846751f456ed19c4c

SHA1
44ac0e9da1eedc31a0fcb7feb25c66f7a1305a47

SHA256
199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7

SHA512
592cb88c02fe4fd27daa52bfa3c8f460f764e34e35fd693328dbad08a01f63a37e4d19fb6dc4c50b5ac3b4ca5a18866a6c4f640c5e958ffe0fc7f830f0c81e23

Download Submit
C:\Users\Admin\AppData\Roaming\ntdlr.exe

Filesize
482KB

MD5
9af8edf2029f46a846751f456ed19c4c

SHA1
44ac0e9da1eedc31a0fcb7feb25c66f7a1305a47

SHA256
199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7

SHA512
592cb88c02fe4fd27daa52bfa3c8f460f764e34e35fd693328dbad08a01f63a37e4d19fb6dc4c50b5ac3b4ca5a18866a6c4f640c5e958ffe0fc7f830f0c81e23

Download Submit
\Users\Admin\AppData\Roaming\ntdlr.exe

Filesize
482KB

MD5
9af8edf2029f46a846751f456ed19c4c

SHA1
44ac0e9da1eedc31a0fcb7feb25c66f7a1305a47

SHA256
199ce03479e486efa6a1e506aad5985cd11476f85add613795566abd397b97f7

SHA512
592cb88c02fe4fd27daa52bfa3c8f460f764e34e35fd693328dbad08a01f63a37e4d19fb6dc4c50b5ac3b4ca5a18866a6c4f640c5e958ffe0fc7f830f0c81e23

Download Submit
memory/364-60-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/364-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1900-68-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1900-62-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/1900-66-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/1900-59-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/1900-58-0x00000000000C82E8-mapping.dmp

Download
memory/1900-57-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/1900-55-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/1916-64-0x0000000000000000-mapping.dmp

Download
memory/1916-77-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2008-74-0x00000000000C82E8-mapping.dmp

Download
memory/2008-79-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download
memory/2008-80-0x00000000000C0000-0x00000000000D1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads