modiloader | a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a

General

Target

a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe
Size

1.1MB
MD5

9d7f8cd2078bb3f8f73236f51e1e5674
SHA1

fd6fe5aafeb1d5b9994b3133579507f23948f555
SHA256

a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a
SHA512

0df765a5ead4c34d3e634a7a5b72203cf7d3c61e3720a343515e348850654684c743e04334feeee8bbb87089ae22edf32f37dfec888c9a3fda3a96e9c6af821c
SSDEEP

24576:yEzLCFOoz9//Q9djUE1bNJT4qodm8D9U5:Ds//Q9FFCDC

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2848-134-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/4632-140-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/4632-141-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

Processes:

Adobeimg.exeAdobeimg.exe

pid process

3504 Adobeimg.exe
4632 Adobeimg.exe

pid	process
3504	Adobeimg.exe
4632	Adobeimg.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Adobeimg.exea8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Adobeimg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Adobeimg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobeimg = "C:\\Users\\Admin\\AppData\\Roaming\\Adobeimg.exe"	Adobeimg.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exeAdobeimg.exe

description	pid	process	target process
PID 4292 set thread context of 2848	4292	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe
PID 3504 set thread context of 4632	3504	Adobeimg.exe	Adobeimg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exeAdobeimg.exe

pid	process
4292	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe
4292	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe
3504	Adobeimg.exe
3504	Adobeimg.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exea8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exeAdobeimg.exe

description	pid	process	target process
PID 4292 wrote to memory of 2848	4292	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe
PID 4292 wrote to memory of 2848	4292	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe
PID 4292 wrote to memory of 2848	4292	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe
PID 2848 wrote to memory of 3504	2848	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe	Adobeimg.exe
PID 2848 wrote to memory of 3504	2848	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe	Adobeimg.exe
PID 2848 wrote to memory of 3504	2848	a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe	Adobeimg.exe
PID 3504 wrote to memory of 4632	3504	Adobeimg.exe	Adobeimg.exe
PID 3504 wrote to memory of 4632	3504	Adobeimg.exe	Adobeimg.exe
PID 3504 wrote to memory of 4632	3504	Adobeimg.exe	Adobeimg.exe

C:\Users\Admin\AppData\Local\Temp\a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe
"C:\Users\Admin\AppData\Local\Temp\a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4292

C:\Users\Admin\AppData\Local\Temp\a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe
"C:\Users\Admin\AppData\Local\Temp\a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2848

C:\Users\Admin\AppData\Roaming\Adobeimg.exe
"C:\Users\Admin\AppData\Roaming\Adobeimg.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3504

C:\Users\Admin\AppData\Roaming\Adobeimg.exe
"C:\Users\Admin\AppData\Roaming\Adobeimg.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobeimg.exe
Filesize
1.1MB

MD5
9d7f8cd2078bb3f8f73236f51e1e5674

SHA1
fd6fe5aafeb1d5b9994b3133579507f23948f555

SHA256
a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a

SHA512
0df765a5ead4c34d3e634a7a5b72203cf7d3c61e3720a343515e348850654684c743e04334feeee8bbb87089ae22edf32f37dfec888c9a3fda3a96e9c6af821c

Download Submit
C:\Users\Admin\AppData\Roaming\Adobeimg.exe
Filesize
1.1MB

MD5
9d7f8cd2078bb3f8f73236f51e1e5674

SHA1
fd6fe5aafeb1d5b9994b3133579507f23948f555

SHA256
a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a

SHA512
0df765a5ead4c34d3e634a7a5b72203cf7d3c61e3720a343515e348850654684c743e04334feeee8bbb87089ae22edf32f37dfec888c9a3fda3a96e9c6af821c

Download Submit
C:\Users\Admin\AppData\Roaming\Adobeimg.exe
Filesize
1.1MB

MD5
9d7f8cd2078bb3f8f73236f51e1e5674

SHA1
fd6fe5aafeb1d5b9994b3133579507f23948f555

SHA256
a8b8fb4481a5864ff034c55e3a01c94049ed90a06a66221d5dec3b118180fa9a

SHA512
0df765a5ead4c34d3e634a7a5b72203cf7d3c61e3720a343515e348850654684c743e04334feeee8bbb87089ae22edf32f37dfec888c9a3fda3a96e9c6af821c

Download Submit
memory/2848-133-0x0000000000000000-mapping.dmp

Download
memory/2848-134-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3504-135-0x0000000000000000-mapping.dmp

Download
memory/4292-132-0x00000000022B0000-0x00000000022B7000-memory.dmp

Filesize
28KB

Download
memory/4632-138-0x0000000000000000-mapping.dmp

Download
memory/4632-140-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4632-141-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads