modiloader | b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c

General

Target

b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe
Size

141KB
MD5

dc72d0c6428e1a95bf4675f87baa03ae
SHA1

aea1a3ed4bc2739dcc6c5a3839b1f2d662a5d5f3
SHA256

b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c
SHA512

70ad47a5f87eb125bc6282ecd29661d963bbd2aa707d4e298e1c0c9c359222477de9e9ae2caa199eb108e38ab2d33b5fddd2810e30048b8eeb1bf393f230f893
SSDEEP

3072:/0gihf/IhPtk9fYl9NkD7jOZlL6/cdILAyrXNipp3LRrCEH+gRrCu5:/ihY1t8fYl9NxyMIfr03eMu2

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1640-55-0x0000000000400000-0x0000000000452138-memory.dmp	modiloader_stage2
behavioral1/memory/1640-59-0x0000000000400000-0x0000000000452138-memory.dmp	modiloader_stage2
behavioral1/memory/952-60-0x0000000000400000-0x0000000000452138-memory.dmp	modiloader_stage2
behavioral1/memory/908-69-0x0000000010410000-0x0000000010465000-memory.dmp	modiloader_stage2
behavioral1/memory/908-70-0x0000000010410000-0x0000000010465000-memory.dmp	modiloader_stage2
behavioral1/memory/952-71-0x0000000000400000-0x0000000000452138-memory.dmp	modiloader_stage2
behavioral1/memory/908-72-0x0000000010410000-0x0000000010465000-memory.dmp	modiloader_stage2
behavioral1/memory/908-73-0x0000000010410000-0x0000000010465000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

netservice.exe

pid process

952 netservice.exe

pid	process
952	netservice.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/952-64-0x0000000010410000-0x0000000010465000-memory.dmp	upx
behavioral1/memory/908-69-0x0000000010410000-0x0000000010465000-memory.dmp	upx
behavioral1/memory/908-70-0x0000000010410000-0x0000000010465000-memory.dmp	upx
behavioral1/memory/908-72-0x0000000010410000-0x0000000010465000-memory.dmp	upx
behavioral1/memory/908-73-0x0000000010410000-0x0000000010465000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2036 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

netservice.exe

description pid process

Token: SeDebugPrivilege 952 netservice.exe

pid	process
2036	cmd.exe

description	pid	process
Token: SeDebugPrivilege	952	netservice.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exenetservice.exe

description	pid	process	target process
PID 1640 wrote to memory of 2036	1640	b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe	cmd.exe
PID 1640 wrote to memory of 2036	1640	b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe	cmd.exe
PID 1640 wrote to memory of 2036	1640	b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe	cmd.exe
PID 1640 wrote to memory of 2036	1640	b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe	cmd.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe
PID 952 wrote to memory of 908	952	netservice.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe
"C:\Users\Admin\AppData\Local\Temp\b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe"
  2⤵
  - Deletes itself
  PID:2036

C:\Users\Admin\Favorites\netservice.exe
C:\Users\Admin\Favorites\netservice.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Favorites\netservice.exe

Filesize
141KB

MD5
dc72d0c6428e1a95bf4675f87baa03ae

SHA1
aea1a3ed4bc2739dcc6c5a3839b1f2d662a5d5f3

SHA256
b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c

SHA512
70ad47a5f87eb125bc6282ecd29661d963bbd2aa707d4e298e1c0c9c359222477de9e9ae2caa199eb108e38ab2d33b5fddd2810e30048b8eeb1bf393f230f893

Download Submit
memory/908-69-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/908-62-0x0000000000000000-mapping.dmp

Download
memory/908-67-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/908-70-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/908-72-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/908-73-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/952-60-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download
memory/952-64-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/952-71-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download
memory/1640-55-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download
memory/1640-59-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download
memory/1640-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/2036-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads