modiloader | 5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4

General

Target

5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
Size

686KB
MD5

68472da76023ead28fb65a00affc13f0
SHA1

2147b9a9b2a67e16322147df1c4387beab974b16
SHA256

5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4
SHA512

bf82c0fcc995aa713ebbe81fe85c6e3ab29aad2c855884028c5905dc408dfd473817e3b8b8ee4ff933b64a7f9a96765f39b682e0491b1845815f387c50b1aeee
SSDEEP

12288:Jjtju6APFo38dPbUpLbQJNBWQ4frvFa4w65DdaN3Rus0SDggZ6YcaPhFTUaM9tnA:VAPq3SbUeXorvjw0daFRr0S0grcIj5MQ

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 12 IoCs

Processes:

resource	yara_rule
behavioral1/memory/560-58-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-62-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-60-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-63-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-65-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-67-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-69-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-70-0x0000000000430464-mapping.dmp	modiloader_stage2
behavioral1/memory/560-71-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-74-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-77-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/560-78-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1520-72-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral1/memory/1520-75-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1520-72-0x0000000000400000-0x00000000004EF000-memory.dmp	autoit_exe
behavioral1/memory/1520-75-0x0000000000400000-0x00000000004EF000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe

description	pid	process	target process
PID 1520 set thread context of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1524 560 WerFault.exe 5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe

pid	pid_target	process	target process
1524	560	WerFault.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe

C:\Users\Admin\AppData\Local\Temp\5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
"C:\Users\Admin\AppData\Local\Temp\5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
  "C:\Users\Admin\AppData\Local\Temp\5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 212
    3⤵
    - Program crash
    PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-67-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-69-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-58-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-62-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-56-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-78-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-71-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-70-0x0000000000430464-mapping.dmp

Download
memory/560-77-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/560-55-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1520-73-0x00000000032B0000-0x000000000339F000-memory.dmp

Filesize
956KB

Download
memory/1520-75-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1520-72-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1520-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1524-79-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 1520 wrote to memory of 560	1520	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe
PID 560 wrote to memory of 1524	560	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	WerFault.exe
PID 560 wrote to memory of 1524	560	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	WerFault.exe
PID 560 wrote to memory of 1524	560	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	WerFault.exe
PID 560 wrote to memory of 1524	560	5ebf68b456b5bb3e70f1dfe6d790c9caf7486dfce700dca2c6e373dbdf8fb0a4.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads