modiloader | f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb

Analysis

max time kernel
189s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb.exe
Size

690KB
MD5

3032257edda1791849566825d5ff1d99
SHA1

5ddfeda08a32abdbfa9264deb30dd46df74469eb
SHA256

f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb
SHA512

75dceebcfe39f6c6f57798bd8088560c6e047b2fc374cd18a5f34bd646dd162ae0771143b1bd315686c81a65ff096a4f667539a5f555e8ed718d6d468b72c65b
SSDEEP

12288:tzy6rRxEu8H7W5dImEVtQkJjDOGIcI/tGW4yrAtSNGC8fpmDH/tcTA:46rTkqdmVSkByEYr4yAtyb8RmTWE

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
C:\Windows\qq.exe	modiloader_stage2
C:\Windows\qq.exe	modiloader_stage2
C:\Windows\WinRaR\WinRaR.exe	modiloader_stage2
C:\Windows\WinRaR\WinRaR.exe	modiloader_stage2

Executes dropped EXE 4 IoCs

Processes:

Keys.exeie.exeqq.exeWinRaR.exe

pid process

2192 Keys.exe
2156 ie.exe
3512 qq.exe
2252 WinRaR.exe

pid	process
2192	Keys.exe
2156	ie.exe
3512	qq.exe
2252	WinRaR.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb.exeKeys.exeWScript.exeie.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	Keys.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	ie.exe

Loads dropped DLL 2 IoCs

Processes:

WinRaR.exe

pid process

2252 WinRaR.exe
2252 WinRaR.exe

pid	process
2252	WinRaR.exe
2252	WinRaR.exe

Drops file in Windows directory 22 IoCs

Processes:

Keys.exeqq.exeWinRaR.exeie.exe

description	ioc	process
File created	C:\Windows\ie.exe	Keys.exe
File created	C:\Windows\knlps.exe	Keys.exe
File opened for modification	C:\Windows\knlps.sys	Keys.exe
File opened for modification	C:\Windows\1.bat	Keys.exe
File created	C:\Windows\11.bat	Keys.exe
File created	C:\Windows\kulion	qq.exe
File opened for modification	C:\Windows\WinRaR\WinRaR.exe	qq.exe
File created	C:\Windows\WinRaR\WinRaR.exe	WinRaR.exe
File created	C:\Windows\1.vbs	Keys.exe
File created	C:\Windows\1.bat	Keys.exe
File created	C:\Windows\qq.exe	ie.exe
File opened for modification	C:\Windows\qq.exe	ie.exe
File opened for modification	C:\Windows\WinRaR\	qq.exe
File created	C:\Windows\WinRaR\WinRaR.dll	qq.exe
File opened for modification	C:\Windows\WinRaR\	WinRaR.exe
File created	C:\Windows\WinRaR\WinRaR.dll	WinRaR.exe
File opened for modification	C:\Windows\1.vbs	Keys.exe
File opened for modification	C:\Windows\ie.exe	Keys.exe
File opened for modification	C:\Windows\knlps.exe	Keys.exe
File created	C:\Windows\knlps.sys	Keys.exe
File created	C:\Windows\WinRaR\WinRaR.exe	qq.exe
File opened for modification	C:\Windows\11.bat	Keys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

Keys.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings Keys.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	Keys.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

qq.exe

description	pid	process
Token: SeBackupPrivilege	3512	qq.exe
Token: SeRestorePrivilege	3512	qq.exe
Token: SeBackupPrivilege	3512	qq.exe
Token: SeRestorePrivilege	3512	qq.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WinRaR.exe

pid process

2252 WinRaR.exe

pid	process
2252	WinRaR.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb.exeKeys.exeWScript.execmd.exeie.exeqq.exe

description	pid	process	target process
PID 4604 wrote to memory of 2192	4604	f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb.exe	Keys.exe
PID 4604 wrote to memory of 2192	4604	f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb.exe	Keys.exe
PID 4604 wrote to memory of 2192	4604	f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb.exe	Keys.exe
PID 2192 wrote to memory of 3168	2192	Keys.exe	WScript.exe
PID 2192 wrote to memory of 3168	2192	Keys.exe	WScript.exe
PID 2192 wrote to memory of 3168	2192	Keys.exe	WScript.exe
PID 3168 wrote to memory of 3692	3168	WScript.exe	cmd.exe
PID 3168 wrote to memory of 3692	3168	WScript.exe	cmd.exe
PID 3168 wrote to memory of 3692	3168	WScript.exe	cmd.exe
PID 3168 wrote to memory of 2292	3168	WScript.exe	cmd.exe
PID 3168 wrote to memory of 2292	3168	WScript.exe	cmd.exe
PID 3168 wrote to memory of 2292	3168	WScript.exe	cmd.exe
PID 2292 wrote to memory of 2156	2292	cmd.exe	ie.exe
PID 2292 wrote to memory of 2156	2292	cmd.exe	ie.exe
PID 2292 wrote to memory of 2156	2292	cmd.exe	ie.exe
PID 2156 wrote to memory of 3512	2156	ie.exe	qq.exe
PID 2156 wrote to memory of 3512	2156	ie.exe	qq.exe
PID 2156 wrote to memory of 3512	2156	ie.exe	qq.exe
PID 3512 wrote to memory of 2252	3512	qq.exe	WinRaR.exe
PID 3512 wrote to memory of 2252	3512	qq.exe	WinRaR.exe
PID 3512 wrote to memory of 2252	3512	qq.exe	WinRaR.exe

C:\Users\Admin\AppData\Local\Temp\f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb.exe
"C:\Users\Admin\AppData\Local\Temp\f681912ca730e36b770946df9b7fd9483334405984a7eee9cc8897f66d7af8eb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4604

C:\Users\Admin\AppData\Local\Temp\Keys.exe
"C:\Users\Admin\AppData\Local\Temp\Keys.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\1.vbs"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\1.bat" "
4⤵
PID:3692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\11.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\ie.exe
ie.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\qq.exe
"C:\Windows\qq.exe"
6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512

C:\Windows\WinRaR\WinRaR.exe
C:\Windows\WinRaR\WinRaR.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2252

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Keys.exe
Filesize
155KB

MD5
e60c4133069c1c814cfea09699a8a73c

SHA1
d9b80449267246c568a510bfb19a9296b9ae5745

SHA256
36f91b043b5f889704a2502435cb26f3119fccc281668c9aebfca630918ca55c

SHA512
ef90ee5c50f0a753fe0239a07edf926177d84fa3470ccd252fcbcbfaf366f3c8f06b1a622b4d3e9ca1479de74d2362b67f148f26d1e5e5390550092278d00074

Download Submit
C:\Users\Admin\AppData\Local\Temp\Keys.exe
Filesize
155KB

MD5
e60c4133069c1c814cfea09699a8a73c

SHA1
d9b80449267246c568a510bfb19a9296b9ae5745

SHA256
36f91b043b5f889704a2502435cb26f3119fccc281668c9aebfca630918ca55c

SHA512
ef90ee5c50f0a753fe0239a07edf926177d84fa3470ccd252fcbcbfaf366f3c8f06b1a622b4d3e9ca1479de74d2362b67f148f26d1e5e5390550092278d00074

Download Submit
C:\Windows\1.bat
Filesize
1KB

MD5
4578af15ca83e4199985a5e9f5f4b2a1

SHA1
02db5425a69f2ec79b17c5e56d76328b2b476ec1

SHA256
f896d2660ca83c995daec5a4d6396faa25fe1c4f76e44c5f37233c3da6a9de60

SHA512
6bcde6bc7f5a4fbfd1e8c3361958a519186b0b88b4e9a33de9b832c731b889089bac8494d5e3dc28459d7e7cae5b8de92b6ad34c22d5e6754c2c9de60c639198

Download Submit
C:\Windows\1.vbs
Filesize
104B

MD5
f36d3e837e1cb99c1b7f6be2ad169ce2

SHA1
745bce46397d7204e41e7ef6361de491771230cc

SHA256
8c3a2fb7046ae91ec46d60d56468503ddf04f05563d98c8cb188ab358ec82f74

SHA512
5e76bb75543ae4742efc21f3c1203735fe2bf9bafc2b3cf0c81108f97e019125e3c9a0108ddef839576742923116013e988bc30974cd6cff6a58d53eaa486d03

Download Submit
C:\Windows\11.bat
Filesize
43B

MD5
247b7afaf8b02e02629c306cd443b250

SHA1
660ee7fc66a85e523f2a3a72587cb98b308915b4

SHA256
c5f9a06abd38192d75f886b073a96c8799cb62ababedeaf933c63f3a276569c6

SHA512
c303301737daec79cbcc91ec758a295ba822c8478485565189a3edfeda78da3ad15ab49dcbc3c0d089032afe7919821db56a2aa06caa53cebb94710091291fc7

Download Submit
C:\Windows\WinRaR\WinRaR.dll
Filesize
25KB

MD5
d7c705bd2817806b2c469fb23956be8e

SHA1
d280a77c5fa4a83be0536882309875e129af1dd3

SHA256
4463b36d6055b5fa2b93f54f304a6247795610b896f30525410f9673c3a95af0

SHA512
97adbc1059a4bc233a6f39448b357691ec82daa6c47c1e3109560656344bf9a7f6d51c9274081721505fa669b08675271f9469ba1c23e548db31318876e3467d

Download Submit
C:\Windows\WinRaR\WinRaR.dll
Filesize
25KB

MD5
d7c705bd2817806b2c469fb23956be8e

SHA1
d280a77c5fa4a83be0536882309875e129af1dd3

SHA256
4463b36d6055b5fa2b93f54f304a6247795610b896f30525410f9673c3a95af0

SHA512
97adbc1059a4bc233a6f39448b357691ec82daa6c47c1e3109560656344bf9a7f6d51c9274081721505fa669b08675271f9469ba1c23e548db31318876e3467d

Download Submit
C:\Windows\WinRaR\WinRaR.dll
Filesize
25KB

MD5
d7c705bd2817806b2c469fb23956be8e

SHA1
d280a77c5fa4a83be0536882309875e129af1dd3

SHA256
4463b36d6055b5fa2b93f54f304a6247795610b896f30525410f9673c3a95af0

SHA512
97adbc1059a4bc233a6f39448b357691ec82daa6c47c1e3109560656344bf9a7f6d51c9274081721505fa669b08675271f9469ba1c23e548db31318876e3467d

Download Submit
C:\Windows\WinRaR\WinRaR.exe
Filesize
56KB

MD5
68e47a99f4b80d1fcae33ff9fae8751e

SHA1
dac30a241f5c397ce5a02cc7be94f16726a322c3

SHA256
ec7ead2d869c2ed630c641db54e59bd1777ccf1c0a1c8be5273ad5d85ab91aca

SHA512
7ee5c52e98ae1251ae24041582d79f377fe62e2e014e456c397d0d3777388dacdc23aee1dcb106132fe58ff07a0154f018d9d65ec8747bd1d9f0698703842d4a

Download Submit
C:\Windows\WinRaR\WinRaR.exe
Filesize
56KB

MD5
68e47a99f4b80d1fcae33ff9fae8751e

SHA1
dac30a241f5c397ce5a02cc7be94f16726a322c3

SHA256
ec7ead2d869c2ed630c641db54e59bd1777ccf1c0a1c8be5273ad5d85ab91aca

SHA512
7ee5c52e98ae1251ae24041582d79f377fe62e2e014e456c397d0d3777388dacdc23aee1dcb106132fe58ff07a0154f018d9d65ec8747bd1d9f0698703842d4a

Download Submit
C:\Windows\ie.exe
Filesize
81KB

MD5
d11e62e27cd8edfb3cfcdc80c5f1062d

SHA1
aea0071cd6517291221e90079ff2b3b5f83ee3af

SHA256
6251ba2ade300d07fcd002b17166f3b06791800134aed7ee4a7db6801569fd3d

SHA512
03acf3003dbe6df222618a3f66e1463d751b0a9d6f5847e44dedb8b4c79af71b3e607ad1e8e4511f3b4d1e0c320b00e667a75d8234845503876cf212e5b77af2

Download Submit
C:\Windows\ie.exe
Filesize
81KB

MD5
d11e62e27cd8edfb3cfcdc80c5f1062d

SHA1
aea0071cd6517291221e90079ff2b3b5f83ee3af

SHA256
6251ba2ade300d07fcd002b17166f3b06791800134aed7ee4a7db6801569fd3d

SHA512
03acf3003dbe6df222618a3f66e1463d751b0a9d6f5847e44dedb8b4c79af71b3e607ad1e8e4511f3b4d1e0c320b00e667a75d8234845503876cf212e5b77af2

Download Submit
C:\Windows\qq.exe
Filesize
56KB

MD5
68e47a99f4b80d1fcae33ff9fae8751e

SHA1
dac30a241f5c397ce5a02cc7be94f16726a322c3

SHA256
ec7ead2d869c2ed630c641db54e59bd1777ccf1c0a1c8be5273ad5d85ab91aca

SHA512
7ee5c52e98ae1251ae24041582d79f377fe62e2e014e456c397d0d3777388dacdc23aee1dcb106132fe58ff07a0154f018d9d65ec8747bd1d9f0698703842d4a

Download Submit
C:\Windows\qq.exe
Filesize
56KB

MD5
68e47a99f4b80d1fcae33ff9fae8751e

SHA1
dac30a241f5c397ce5a02cc7be94f16726a322c3

SHA256
ec7ead2d869c2ed630c641db54e59bd1777ccf1c0a1c8be5273ad5d85ab91aca

SHA512
7ee5c52e98ae1251ae24041582d79f377fe62e2e014e456c397d0d3777388dacdc23aee1dcb106132fe58ff07a0154f018d9d65ec8747bd1d9f0698703842d4a

Download Submit
memory/2156-152-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2156-148-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2156-147-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2156-144-0x0000000000000000-mapping.dmp

Download
memory/2192-132-0x0000000000000000-mapping.dmp

Download
memory/2192-134-0x0000000000400000-0x0000000000430214-memory.dmp

Filesize
192KB

Download
memory/2192-136-0x0000000000400000-0x0000000000430214-memory.dmp

Filesize
192KB

Download
memory/2192-138-0x0000000000400000-0x0000000000430214-memory.dmp

Filesize
192KB

Download
memory/2252-159-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/2252-153-0x0000000000000000-mapping.dmp

Download
memory/2292-143-0x0000000000000000-mapping.dmp

Download
memory/3168-137-0x0000000000000000-mapping.dmp

Download
memory/3512-149-0x0000000000000000-mapping.dmp

Download
memory/3692-141-0x0000000000000000-mapping.dmp

Download