modiloader | 2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931

Analysis

max time kernel
151s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe
Size

36KB
MD5

8b11fcbc2fa80f11bdd644659e2cb844
SHA1

3964596d22afdcf3fce980823998bbb78e89b512
SHA256

2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931
SHA512

8e59db17a897c6282e05a36d1e1c805cca5451879f73d6afb6140e5facd1a319be399eefc3f08b29974933763ed0ad7d00ffb40fc559bb8f06f825a0f8a23444
SSDEEP

768:jycqOQ0bwMK2M3fQde8Pfymg0M9EQfRo0ys/Kz/:WcqOQbB3fQc8Pfymg0yxpByxz/

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\svchost.exe	modiloader_stage2
\Users\Admin\AppData\Roaming\svchost.exe	modiloader_stage2
C:\Users\Admin\AppData\Roaming\svchost.exe	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1708 svchost.exe

pid	process
1708	svchost.exe

Loads dropped DLL 2 IoCs

Processes:

2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe

pid	process
364	2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe
364	2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe

description	pid	process	target process
PID 364 wrote to memory of 1708	364	2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe	svchost.exe
PID 364 wrote to memory of 1708	364	2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe	svchost.exe
PID 364 wrote to memory of 1708	364	2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe	svchost.exe
PID 364 wrote to memory of 1708	364	2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe
"C:\Users\Admin\AppData\Local\Temp\2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
36KB

MD5
8b11fcbc2fa80f11bdd644659e2cb844

SHA1
3964596d22afdcf3fce980823998bbb78e89b512

SHA256
2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931

SHA512
8e59db17a897c6282e05a36d1e1c805cca5451879f73d6afb6140e5facd1a319be399eefc3f08b29974933763ed0ad7d00ffb40fc559bb8f06f825a0f8a23444

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe
Filesize
36KB

MD5
8b11fcbc2fa80f11bdd644659e2cb844

SHA1
3964596d22afdcf3fce980823998bbb78e89b512

SHA256
2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931

SHA512
8e59db17a897c6282e05a36d1e1c805cca5451879f73d6afb6140e5facd1a319be399eefc3f08b29974933763ed0ad7d00ffb40fc559bb8f06f825a0f8a23444

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe
Filesize
36KB

MD5
8b11fcbc2fa80f11bdd644659e2cb844

SHA1
3964596d22afdcf3fce980823998bbb78e89b512

SHA256
2737e9ada1b8571b386de6cc6bebcb166572928428e14c9772546c46422cb931

SHA512
8e59db17a897c6282e05a36d1e1c805cca5451879f73d6afb6140e5facd1a319be399eefc3f08b29974933763ed0ad7d00ffb40fc559bb8f06f825a0f8a23444

Download Submit
memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1708-57-0x0000000000000000-mapping.dmp

Download