modiloader | 2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850

General

Target

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe
Size

21.0MB
MD5

792f500cbd8383e396ca9403f4702d04
SHA1

ac46f083543eeaab57d018861f3cc77eeffb145c
SHA256

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850
SHA512

4b4b3e6bc5917c1af7efa4f7e87ef977e4deb0ce31a6c96e193098445caa2b0891fd7e832502d2dea0f78548be067c82652e51e44a90cea2aba51e8c0610f842
SSDEEP

3072:3+wj//NU9iz5r5t+9M758JFgNMAH1se/xWWEHhQXS1ENhV732k9Hc3/nl6LAHkzc:5//NGK+9M758MmH4AETV7Gk96dAD

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1732-70-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral1/memory/1732-71-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1732-59-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1732-61-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1732-62-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1732-67-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1732-69-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1732-70-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1732-71-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe"	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description	pid	process	target process
PID 1364 set thread context of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

pid process

1364 2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description pid process

Token: SeDebugPrivilege 1364 2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

pid	process
1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description	pid	process
Token: SeDebugPrivilege	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description	pid	process	target process
PID 1364 wrote to memory of 1216	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 1364 wrote to memory of 1216	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 1364 wrote to memory of 1216	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 1364 wrote to memory of 1216	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 1364 wrote to memory of 1216	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 1364 wrote to memory of 1216	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 1364 wrote to memory of 1216	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 1364 wrote to memory of 1732	1364	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe
"C:\Users\Admin\AppData\Local\Temp\2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1.vbs"
2⤵
- Adds Run key to start application
PID:1216

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\\AppLaunch.exe"
2⤵
PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.vbs

Filesize
495B

MD5
ac34f64164e1e106487eaadb838a8efe

SHA1
cae9fcb9135600800b04a90352d26ac14ce3fefc

SHA256
32ee3de4802a19f8bc0ca7a8c16d711a6b432474c041793463fa341709a7c668

SHA512
d0608c5a080cf6293ccad4efd7edbaf43239769033cebc614d777b50b0d411823ccb8c08f135d009d7f51b834a719f4c9f687e8392c48fe63bfa33aa87c8f31d

Download Submit
memory/1216-56-0x0000000000000000-mapping.dmp

Download
memory/1364-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-55-0x0000000074310000-0x00000000748BB000-memory.dmp

Filesize
5.7MB

Download
memory/1364-72-0x0000000074310000-0x00000000748BB000-memory.dmp

Filesize
5.7MB

Download
memory/1732-62-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1732-61-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1732-63-0x0000000000412D30-mapping.dmp

Download
memory/1732-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1732-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1732-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1732-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1732-71-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1732-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads