modiloader | 7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d

General

Target

7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
Size

64KB
MD5

7a831aa21de56ddfd228c7905014129d
SHA1

d33ef9f3d2e9d954d15cca738950c0599e55f928
SHA256

7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d
SHA512

1f85230fe2d2ca02f56ae560122d4234cdd2d01e4f938dc39b7ce298fbd1a7f59f3798488fcf6a83f736242468c0b1346a7fbe26a85eac65039e1e584fcd723a
SSDEEP

1536:y25EkILskdGy1lwXhRBKRqghaGsAF3l6G:ygpgGrXhReFFFoG

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4316-135-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/4316-136-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/4316-138-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/4316-140-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regloader = "C:\\Users\\Admin\\AppData\\Roaming\\coreloader.exe"	REG.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe

description	pid	process	target process
PID 1836 set thread context of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe

pid	process
1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe

description pid process

Token: SeDebugPrivilege 1836 7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe

description	pid	process
Token: SeDebugPrivilege	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe

description	pid	process	target process
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 4316	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
PID 1836 wrote to memory of 1852	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	REG.exe
PID 1836 wrote to memory of 1852	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	REG.exe
PID 1836 wrote to memory of 1852	1836	7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
"C:\Users\Admin\AppData\Local\Temp\7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Local\Temp\7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe
"C:\Users\Admin\AppData\Local\Temp\7454023e71579b77429290761115027a61fa0e286eca53921147cd994f29187d.exe"
2⤵
PID:4316

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "regloader" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\coreloader.exe
2⤵
- Adds Run key to start application
PID:1852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-132-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/1836-133-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/1836-139-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/1852-137-0x0000000000000000-mapping.dmp

Download
memory/4316-134-0x0000000000000000-mapping.dmp

Download
memory/4316-135-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4316-136-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4316-138-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4316-140-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads