modiloader | 1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe
Size

18KB
MD5

d4abc2ba873ae797d1f72f7cebc9a6aa
SHA1

34b2f0d46ef51daed2848ec416d799a049e41c4b
SHA256

1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9
SHA512

b7f2cef8de58def9fa817de418835afa63efb0866741494a020ed8f8b8c001ddb68aa6847e2f6bff839904f976abd7128b768f13d1b632b73db58a82ca148259
SSDEEP

384:0Ew7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1CzciYqhne:0Ew7wkHOYEGPvCaV4pLzb1fiY

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1896-59-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral1/memory/1092-61-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

esadsadsad.exe

pid process

1092 esadsadsad.exe

pid	process
1092	esadsadsad.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\esadsadsad.exe	upx
\Users\Admin\AppData\Roaming\esadsadsad.exe	upx
behavioral1/memory/1896-59-0x0000000000400000-0x0000000000414000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\esadsadsad.exe	upx
behavioral1/memory/1092-61-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe

pid	process
1896	1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe
1896	1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

esadsadsad.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\esadsadsad.exe"	esadsadsad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe

description	pid	process	target process
PID 1896 wrote to memory of 1092	1896	1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe	esadsadsad.exe
PID 1896 wrote to memory of 1092	1896	1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe	esadsadsad.exe
PID 1896 wrote to memory of 1092	1896	1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe	esadsadsad.exe
PID 1896 wrote to memory of 1092	1896	1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe	esadsadsad.exe

C:\Users\Admin\AppData\Local\Temp\1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe
"C:\Users\Admin\AppData\Local\Temp\1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896

C:\Users\Admin\AppData\Roaming\esadsadsad.exe
"C:\Users\Admin\AppData\Roaming\esadsadsad.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\esadsadsad.exe
Filesize
18KB

MD5
d4abc2ba873ae797d1f72f7cebc9a6aa

SHA1
34b2f0d46ef51daed2848ec416d799a049e41c4b

SHA256
1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9

SHA512
b7f2cef8de58def9fa817de418835afa63efb0866741494a020ed8f8b8c001ddb68aa6847e2f6bff839904f976abd7128b768f13d1b632b73db58a82ca148259

Download Submit
\Users\Admin\AppData\Roaming\esadsadsad.exe
Filesize
18KB

MD5
d4abc2ba873ae797d1f72f7cebc9a6aa

SHA1
34b2f0d46ef51daed2848ec416d799a049e41c4b

SHA256
1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9

SHA512
b7f2cef8de58def9fa817de418835afa63efb0866741494a020ed8f8b8c001ddb68aa6847e2f6bff839904f976abd7128b768f13d1b632b73db58a82ca148259

Download Submit
\Users\Admin\AppData\Roaming\esadsadsad.exe
Filesize
18KB

MD5
d4abc2ba873ae797d1f72f7cebc9a6aa

SHA1
34b2f0d46ef51daed2848ec416d799a049e41c4b

SHA256
1b61e2113043bedb3e9b7350d7e789c0a5b98684a0c94ad9dd8e393e4cc425f9

SHA512
b7f2cef8de58def9fa817de418835afa63efb0866741494a020ed8f8b8c001ddb68aa6847e2f6bff839904f976abd7128b768f13d1b632b73db58a82ca148259

Download Submit
memory/1092-57-0x0000000000000000-mapping.dmp

Download
memory/1092-61-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1896-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1896-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download