modiloader | ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3

General

Target

ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe
Size

635KB
MD5

0f3d57bbfc63403dc20941918d29dba4
SHA1

c4293167f4daadbaf02493cf2d5583564e7e61c0
SHA256

ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3
SHA512

6b7fcccc5b569a1d1fa1915de14efe5d355252453452b01afc97664c1dd70394fb170f9e4502785ff1c3afcde66ab0b1c8b5917e4608e42177d702ec2c6c5963
SSDEEP

3072:0/UgvS5YtLDWnRs3R6o/Atccm7x2Ix6hmjxwxufni2xylViCVsE+K1wU7oG2tQdl:wLDmuC61cIxLjxwaXx/CSaVddfTB

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/536-56-0x0000000000400000-0x00000000004B6000-memory.dmp	modiloader_stage2
behavioral1/memory/536-61-0x0000000000400000-0x00000000004B6000-memory.dmp	modiloader_stage2
behavioral1/memory/1868-64-0x0000000000400000-0x00000000004B6000-memory.dmp	modiloader_stage2
behavioral1/memory/1868-65-0x0000000000400000-0x00000000004B6000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

AdobeART.exe

pid process

1868 AdobeART.exe

pid	process
1868	AdobeART.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/536-56-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/536-61-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/1868-64-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral1/memory/1868-65-0x0000000000400000-0x00000000004B6000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe

pid	process
536	ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe
536	ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AdobeART.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe"	AdobeART.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exeAdobeART.exe

pid process

536 ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe
1868 AdobeART.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe

description	pid	process	target process
PID 536 wrote to memory of 1868	536	ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe	AdobeART.exe
PID 536 wrote to memory of 1868	536	ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe	AdobeART.exe
PID 536 wrote to memory of 1868	536	ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe	AdobeART.exe
PID 536 wrote to memory of 1868	536	ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe	AdobeART.exe

C:\Users\Admin\AppData\Local\Temp\ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe
"C:\Users\Admin\AppData\Local\Temp\ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Roaming\AdobeART.exe
"C:\Users\Admin\AppData\Roaming\AdobeART.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:1868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AdobeART.exe
Filesize
635KB

MD5
0f3d57bbfc63403dc20941918d29dba4

SHA1
c4293167f4daadbaf02493cf2d5583564e7e61c0

SHA256
ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3

SHA512
6b7fcccc5b569a1d1fa1915de14efe5d355252453452b01afc97664c1dd70394fb170f9e4502785ff1c3afcde66ab0b1c8b5917e4608e42177d702ec2c6c5963

Download Submit
\Users\Admin\AppData\Roaming\AdobeART.exe
Filesize
635KB

MD5
0f3d57bbfc63403dc20941918d29dba4

SHA1
c4293167f4daadbaf02493cf2d5583564e7e61c0

SHA256
ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3

SHA512
6b7fcccc5b569a1d1fa1915de14efe5d355252453452b01afc97664c1dd70394fb170f9e4502785ff1c3afcde66ab0b1c8b5917e4608e42177d702ec2c6c5963

Download Submit
\Users\Admin\AppData\Roaming\AdobeART.exe
Filesize
635KB

MD5
0f3d57bbfc63403dc20941918d29dba4

SHA1
c4293167f4daadbaf02493cf2d5583564e7e61c0

SHA256
ffd9aaab75594402e924111d5d3de999d509ecd0ae684a438609cb825b0781c3

SHA512
6b7fcccc5b569a1d1fa1915de14efe5d355252453452b01afc97664c1dd70394fb170f9e4502785ff1c3afcde66ab0b1c8b5917e4608e42177d702ec2c6c5963

Download Submit
memory/536-54-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/536-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/536-56-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/536-61-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1868-59-0x0000000000000000-mapping.dmp

Download
memory/1868-62-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1868-64-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1868-65-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads