modiloader | b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d

General

Target

b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe
Size

18KB
MD5

706cbc4703d393193e93bcfaecb4206a
SHA1

b371c23d5ce34d59d2df441c4b325b50c130cb1c
SHA256

b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d
SHA512

28f999914ce5a20797a954eaaad99496506fc679ee735042fe377389a44a6e09a77a0133edb9484ab054a57baa2a88a783fb83156f570b0d07eda543e98b806b
SSDEEP

384:ZEw7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1Czcf1R6gne:ZEw7wkHOYEGPvCaV4pLzb1fL

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/952-59-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral1/memory/1044-62-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

AdobeART.exe

pid process

1044 AdobeART.exe

pid	process
1044	AdobeART.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/952-55-0x0000000000400000-0x0000000000414000-memory.dmp	upx
\Users\Admin\AppData\Roaming\AdobeART.exe	upx
\Users\Admin\AppData\Roaming\AdobeART.exe	upx
C:\Users\Admin\AppData\Roaming\AdobeART.exe	upx
behavioral1/memory/952-59-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1044-62-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe

pid	process
952	b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe
952	b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AdobeART.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe"	AdobeART.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe

description	pid	process	target process
PID 952 wrote to memory of 1044	952	b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe	AdobeART.exe
PID 952 wrote to memory of 1044	952	b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe	AdobeART.exe
PID 952 wrote to memory of 1044	952	b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe	AdobeART.exe
PID 952 wrote to memory of 1044	952	b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe	AdobeART.exe

C:\Users\Admin\AppData\Local\Temp\b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe
"C:\Users\Admin\AppData\Local\Temp\b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Roaming\AdobeART.exe
"C:\Users\Admin\AppData\Roaming\AdobeART.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AdobeART.exe
Filesize
18KB

MD5
706cbc4703d393193e93bcfaecb4206a

SHA1
b371c23d5ce34d59d2df441c4b325b50c130cb1c

SHA256
b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d

SHA512
28f999914ce5a20797a954eaaad99496506fc679ee735042fe377389a44a6e09a77a0133edb9484ab054a57baa2a88a783fb83156f570b0d07eda543e98b806b

Download Submit
\Users\Admin\AppData\Roaming\AdobeART.exe
Filesize
18KB

MD5
706cbc4703d393193e93bcfaecb4206a

SHA1
b371c23d5ce34d59d2df441c4b325b50c130cb1c

SHA256
b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d

SHA512
28f999914ce5a20797a954eaaad99496506fc679ee735042fe377389a44a6e09a77a0133edb9484ab054a57baa2a88a783fb83156f570b0d07eda543e98b806b

Download Submit
\Users\Admin\AppData\Roaming\AdobeART.exe
Filesize
18KB

MD5
706cbc4703d393193e93bcfaecb4206a

SHA1
b371c23d5ce34d59d2df441c4b325b50c130cb1c

SHA256
b57d794707aea61e8af1457b6f688afe6039b50a072d664710d36df374e5a55d

SHA512
28f999914ce5a20797a954eaaad99496506fc679ee735042fe377389a44a6e09a77a0133edb9484ab054a57baa2a88a783fb83156f570b0d07eda543e98b806b

Download Submit
memory/952-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/952-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/952-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1044-58-0x0000000000000000-mapping.dmp

Download
memory/1044-62-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads