modiloader | 2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850

General

Target

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe
Size

21.0MB
MD5

792f500cbd8383e396ca9403f4702d04
SHA1

ac46f083543eeaab57d018861f3cc77eeffb145c
SHA256

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850
SHA512

4b4b3e6bc5917c1af7efa4f7e87ef977e4deb0ce31a6c96e193098445caa2b0891fd7e832502d2dea0f78548be067c82652e51e44a90cea2aba51e8c0610f842
SSDEEP

3072:3+wj//NU9iz5r5t+9M758JFgNMAH1se/xWWEHhQXS1ENhV732k9Hc3/nl6LAHkzc:5//NGK+9M758MmH4AETV7Gk96dAD

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4720-139-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/4720-140-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4720-135-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4720-138-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4720-139-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4720-140-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe"	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description	pid	process	target process
PID 4340 set thread context of 4720	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

pid	process
4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe
4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description pid process

Token: SeDebugPrivilege 4340 2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description	pid	process
Token: SeDebugPrivilege	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe

description	pid	process	target process
PID 4340 wrote to memory of 5012	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 4340 wrote to memory of 5012	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 4340 wrote to memory of 5012	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	WScript.exe
PID 4340 wrote to memory of 4720	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 4340 wrote to memory of 4720	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 4340 wrote to memory of 4720	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 4340 wrote to memory of 4720	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 4340 wrote to memory of 4720	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 4340 wrote to memory of 4720	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe
PID 4340 wrote to memory of 4720	4340	2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe
"C:\Users\Admin\AppData\Local\Temp\2181882fcb8e5ad289c1b22a125301a7d626a293bdad97fbf94956d941215850.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1.vbs"
2⤵
- Adds Run key to start application
PID:5012

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\\AppLaunch.exe"
2⤵
PID:4720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.vbs

Filesize
495B

MD5
ac34f64164e1e106487eaadb838a8efe

SHA1
cae9fcb9135600800b04a90352d26ac14ce3fefc

SHA256
32ee3de4802a19f8bc0ca7a8c16d711a6b432474c041793463fa341709a7c668

SHA512
d0608c5a080cf6293ccad4efd7edbaf43239769033cebc614d777b50b0d411823ccb8c08f135d009d7f51b834a719f4c9f687e8392c48fe63bfa33aa87c8f31d

Download Submit
memory/4340-132-0x0000000075010000-0x00000000755C1000-memory.dmp

Filesize
5.7MB

Download
memory/4340-141-0x0000000075010000-0x00000000755C1000-memory.dmp

Filesize
5.7MB

Download
memory/4720-134-0x0000000000000000-mapping.dmp

Download
memory/4720-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4720-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4720-139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4720-140-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5012-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads