modiloader | ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e

General

Target

ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe
Size

454KB
MD5

f9e25196de78400471bfc86ba6a1b001
SHA1

c5b814c0b4e45cf87cbce725f6e52f0c492cfbbd
SHA256

ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e
SHA512

3be48fe0b6a91a97699779990439a23010099e97195965d722adf9f4dee107675b3c427398ec34cedf3918368b459c78d37639048e2ccd9f58af6d8a637f985d
SSDEEP

12288:1rNG8e5lVblWi0HkQsmcApZuXZoL5NQ+WFlhGUfE2yY3PrgNaoUwFnd4TIYk:1rNG87i0HvBkEQ+2FfqYfrhzwtdZYk

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1608-133-0x0000000000400000-0x000000000053D000-memory.dmp	modiloader_stage2
behavioral2/memory/1608-135-0x0000000000401000-0x000000000049A000-memory.dmp	modiloader_stage2
behavioral2/memory/1608-136-0x0000000000400000-0x000000000053D000-memory.dmp	modiloader_stage2

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe

pid process

1608 ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe

pid	process
1608	ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe

description	pid	process	target process
PID 1608 set thread context of 4228	1608	ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe	IEXPLORE.EXE

Drops file in Program Files directory 1 IoCs

Processes:

ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2993716558"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377104294"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DD58E0C6-7577-11ED-A0EE-7ADCB3813C8F} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2985434393"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2985434393"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000964"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000964"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000964"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

4228 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

4228 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

4228 IEXPLORE.EXE
4228 IEXPLORE.EXE
4988 IEXPLORE.EXE
4988 IEXPLORE.EXE
4988 IEXPLORE.EXE
4988 IEXPLORE.EXE

pid	process
4228	IEXPLORE.EXE

pid	process
4228	IEXPLORE.EXE

pid	process
4228	IEXPLORE.EXE
4228	IEXPLORE.EXE
4988	IEXPLORE.EXE
4988	IEXPLORE.EXE
4988	IEXPLORE.EXE
4988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exeIEXPLORE.EXE

description	pid	process	target process
PID 1608 wrote to memory of 4228	1608	ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe	IEXPLORE.EXE
PID 1608 wrote to memory of 4228	1608	ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe	IEXPLORE.EXE
PID 1608 wrote to memory of 4228	1608	ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe	IEXPLORE.EXE
PID 4228 wrote to memory of 4988	4228	IEXPLORE.EXE	IEXPLORE.EXE
PID 4228 wrote to memory of 4988	4228	IEXPLORE.EXE	IEXPLORE.EXE
PID 4228 wrote to memory of 4988	4228	IEXPLORE.EXE	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe
"C:\Users\Admin\AppData\Local\Temp\ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1608

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4228 CREDAT:17410 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
f8f8086f87156d14091b152fcaadc3ce

SHA1
fe3cfbf9e2e871c948300473593dfcf189013386

SHA256
8d92f28b70ed5265fafad8b37ce049b0b8ecad038745173acc35a21b8222bf56

SHA512
1235be77513694a1478459e999631920be42183a6993dc1f93333831eaa54ea60c7d8617029289c95fed2f861fc7aa79da551c128df4428d23752044eb68ba7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
55e79d48bdbb2c19f476a897e397afb9

SHA1
38325a609deb132d760c8c6fab6bd0a9c8f93e20

SHA256
78d155835fc5e739b5fb057006002ef8e30804f14c8121e88f721c7f8c202108

SHA512
31ac8556d448d7a58353fb41c2425bd95c75892eb13633e51d050ee7ac7767885e6556f40d6e1a53204cd9bc3c939874ec991e537ab90f4b27cda86add3f0669

Download Submit
memory/1608-132-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1608-133-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1608-135-0x0000000000401000-0x000000000049A000-memory.dmp

Filesize
612KB

Download
memory/1608-136-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads