modiloader | b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c

General

Target

b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe
Size

141KB
MD5

dc72d0c6428e1a95bf4675f87baa03ae
SHA1

aea1a3ed4bc2739dcc6c5a3839b1f2d662a5d5f3
SHA256

b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c
SHA512

70ad47a5f87eb125bc6282ecd29661d963bbd2aa707d4e298e1c0c9c359222477de9e9ae2caa199eb108e38ab2d33b5fddd2810e30048b8eeb1bf393f230f893
SSDEEP

3072:/0gihf/IhPtk9fYl9NkD7jOZlL6/cdILAyrXNipp3LRrCEH+gRrCu5:/ihY1t8fYl9NxyMIfr03eMu2

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 9 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5032-133-0x0000000000400000-0x0000000000452138-memory.dmp	modiloader_stage2
behavioral2/memory/5032-137-0x0000000000400000-0x0000000000452138-memory.dmp	modiloader_stage2
behavioral2/memory/1180-138-0x0000000000400000-0x0000000000452138-memory.dmp	modiloader_stage2
behavioral2/memory/1180-141-0x0000000000400000-0x0000000000452138-memory.dmp	modiloader_stage2
behavioral2/memory/3796-145-0x0000000010410000-0x0000000010465000-memory.dmp	modiloader_stage2
behavioral2/memory/3796-146-0x0000000010410000-0x0000000010465000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-147-0x0000000000400000-0x0000000000452138-memory.dmp	modiloader_stage2
behavioral2/memory/3796-148-0x0000000010410000-0x0000000010465000-memory.dmp	modiloader_stage2
behavioral2/memory/3796-149-0x0000000010410000-0x0000000010465000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

netservice.exe

pid process

1180 netservice.exe

pid	process
1180	netservice.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1180-142-0x0000000010410000-0x0000000010465000-memory.dmp	upx
behavioral2/memory/3796-145-0x0000000010410000-0x0000000010465000-memory.dmp	upx
behavioral2/memory/3796-146-0x0000000010410000-0x0000000010465000-memory.dmp	upx
behavioral2/memory/3796-148-0x0000000010410000-0x0000000010465000-memory.dmp	upx
behavioral2/memory/3796-149-0x0000000010410000-0x0000000010465000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4316 3796 WerFault.exe svchost.exe
4284 3796 WerFault.exe svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

netservice.exe

description pid process

Token: SeDebugPrivilege 1180 netservice.exe

pid	pid_target	process	target process
4316	3796	WerFault.exe	svchost.exe
4284	3796	WerFault.exe	svchost.exe

description	pid	process
Token: SeDebugPrivilege	1180	netservice.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exenetservice.exe

description	pid	process	target process
PID 5032 wrote to memory of 4196	5032	b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe	cmd.exe
PID 5032 wrote to memory of 4196	5032	b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe	cmd.exe
PID 5032 wrote to memory of 4196	5032	b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe	cmd.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe
PID 1180 wrote to memory of 3796	1180	netservice.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe
"C:\Users\Admin\AppData\Local\Temp\b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c.exe"
  2⤵
  PID:4196

C:\Users\Admin\Favorites\netservice.exe
C:\Users\Admin\Favorites\netservice.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1008
    3⤵
    - Program crash
    PID:4316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 996
    3⤵
    - Program crash
    PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3796 -ip 3796
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3796 -ip 3796
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Favorites\netservice.exe

Filesize
141KB

MD5
dc72d0c6428e1a95bf4675f87baa03ae

SHA1
aea1a3ed4bc2739dcc6c5a3839b1f2d662a5d5f3

SHA256
b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c

SHA512
70ad47a5f87eb125bc6282ecd29661d963bbd2aa707d4e298e1c0c9c359222477de9e9ae2caa199eb108e38ab2d33b5fddd2810e30048b8eeb1bf393f230f893

Download Submit
C:\Users\Admin\Favorites\netservice.exe

Filesize
141KB

MD5
dc72d0c6428e1a95bf4675f87baa03ae

SHA1
aea1a3ed4bc2739dcc6c5a3839b1f2d662a5d5f3

SHA256
b7627ae6a4fc23b31d0e4462be07316a9cff24e564821e7f26c8f9beaad17b5c

SHA512
70ad47a5f87eb125bc6282ecd29661d963bbd2aa707d4e298e1c0c9c359222477de9e9ae2caa199eb108e38ab2d33b5fddd2810e30048b8eeb1bf393f230f893

Download Submit
memory/1180-138-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download
memory/1180-141-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download
memory/1180-142-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/1180-147-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download
memory/3796-140-0x0000000000000000-mapping.dmp

Download
memory/3796-145-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/3796-146-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/3796-148-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/3796-149-0x0000000010410000-0x0000000010465000-memory.dmp

Filesize
340KB

Download
memory/4196-136-0x0000000000000000-mapping.dmp

Download
memory/5032-133-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download
memory/5032-137-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download
memory/5032-132-0x0000000000400000-0x0000000000452138-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads