modiloader | fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d

General

Target

fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
Size

456KB
MD5

15e710ddcab46efea8056305fdaeb3ad
SHA1

204c1b48f327152d612dc80e624e5b1ce7b8a142
SHA256

fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d
SHA512

bca3ba3d787421bc48c364653802b70156be4c8d8cebd88e0246cf60ef96464f44168f4329e0dba600c58b42aca7f07fedda450ce22041625b7dce827814fedd
SSDEEP

12288:LGze7BC6FwCqk/buPkUmLIVxHti1APeQlg9pAFfo1rpK:iSsRxk/bgzWIVz5PeKg9qf8k

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4068-135-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2
behavioral2/memory/4068-136-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2
behavioral2/memory/4068-137-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2
behavioral2/memory/4068-138-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2
behavioral2/memory/4068-139-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exefa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe"	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

description	pid	process	target process
PID 3200 set thread context of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

pid	process
3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

pid	process
3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

description	pid	process	target process
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
PID 3200 wrote to memory of 4068	3200	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe	fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe

C:\Users\Admin\AppData\Local\Temp\fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
"C:\Users\Admin\AppData\Local\Temp\fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200

C:\Users\Admin\AppData\Local\Temp\fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
C:\Users\Admin\AppData\Local\Temp\fa1bd226780a52c8da5aa690ab45d9d34d640eff66a9da0e291be36656f5b10d.exe
2⤵
- Adds Run key to start application
PID:4068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3200-133-0x0000000000660000-0x0000000000664000-memory.dmp

Filesize
16KB

Download
memory/4068-134-0x0000000000000000-mapping.dmp

Download
memory/4068-135-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4068-136-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4068-137-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4068-138-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4068-139-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads