modiloader | db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a

General

Target

db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe
Size

367KB
MD5

025637736b269921d1567d30bf788165
SHA1

3bac77b0671c4235fe7247429579a912fa79d7ba
SHA256

db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a
SHA512

f85373a9e73fec734398138d424cbaaf4cc1db36969db0eb01b1ed46e2f4102295b616791c5ea1677968493f231ef5b8af22bdadbd0dbf594701bcb6d9f246b4
SSDEEP

6144:g/0uolCkQtmlxdpMo+JR6qVEO0FAA3Ny7lKD/PGq8JM9p9gT4ayMo2isG4PoE:gJzkncxajT7Ge9paTV9o2O4PoE

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 7 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe	modiloader_stage2
\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe	modiloader_stage2
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe	modiloader_stage2
\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe	modiloader_stage2
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe	modiloader_stage2
behavioral1/memory/1912-63-0x0000000000400000-0x00000000004BF600-memory.dmp	modiloader_stage2
behavioral1/memory/1912-64-0x0000000000400000-0x00000000004BF600-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

2.exe

pid process

1912 2.exe

pid	process
1912	2.exe

Loads dropped DLL 3 IoCs

Processes:

db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe2.exe

pid	process
836	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe
836	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe
1912	2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2.exe

description pid process target process

PID 1912 set thread context of 2012 1912 2.exe IEXPLORE.EXE
Drops file in Program Files directory 1 IoCs

Processes:

2.exe

description ioc process

File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt 2.exe

description	pid	process	target process
PID 1912 set thread context of 2012	1912	2.exe	IEXPLORE.EXE

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	2.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377152013"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECD8E271-75E6-11ED-BD75-FAF5FAF3A79A} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2012 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

2012 IEXPLORE.EXE
2012 IEXPLORE.EXE
1532 IEXPLORE.EXE
1532 IEXPLORE.EXE
1532 IEXPLORE.EXE
1532 IEXPLORE.EXE

pid	process
2012	IEXPLORE.EXE

pid	process
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe2.exeIEXPLORE.EXE

description	pid	process	target process
PID 836 wrote to memory of 1912	836	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe	2.exe
PID 836 wrote to memory of 1912	836	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe	2.exe
PID 836 wrote to memory of 1912	836	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe	2.exe
PID 836 wrote to memory of 1912	836	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe	2.exe
PID 836 wrote to memory of 1912	836	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe	2.exe
PID 836 wrote to memory of 1912	836	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe	2.exe
PID 836 wrote to memory of 1912	836	db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe	2.exe
PID 1912 wrote to memory of 2012	1912	2.exe	IEXPLORE.EXE
PID 1912 wrote to memory of 2012	1912	2.exe	IEXPLORE.EXE
PID 1912 wrote to memory of 2012	1912	2.exe	IEXPLORE.EXE
PID 1912 wrote to memory of 2012	1912	2.exe	IEXPLORE.EXE
PID 1912 wrote to memory of 2012	1912	2.exe	IEXPLORE.EXE
PID 1912 wrote to memory of 2012	1912	2.exe	IEXPLORE.EXE
PID 1912 wrote to memory of 2012	1912	2.exe	IEXPLORE.EXE
PID 1912 wrote to memory of 2012	1912	2.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 1532	2012	IEXPLORE.EXE	IEXPLORE.EXE
PID 2012 wrote to memory of 1532	2012	IEXPLORE.EXE	IEXPLORE.EXE
PID 2012 wrote to memory of 1532	2012	IEXPLORE.EXE	IEXPLORE.EXE
PID 2012 wrote to memory of 1532	2012	IEXPLORE.EXE	IEXPLORE.EXE
PID 2012 wrote to memory of 1532	2012	IEXPLORE.EXE	IEXPLORE.EXE
PID 2012 wrote to memory of 1532	2012	IEXPLORE.EXE	IEXPLORE.EXE
PID 2012 wrote to memory of 1532	2012	IEXPLORE.EXE	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe
"C:\Users\Admin\AppData\Local\Temp\db3c5b7ad4281991c3b1e6ff4a8506a88315bf068c2fbaa60c24c9214238bd9a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1912

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1532

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
Filesize
762KB

MD5
9537ab889e2a2fe1324af606ec24f91b

SHA1
a6d98cdea02597d1fb105b6c05c3616f0d535da2

SHA256
c2ca18c48e868a7c8e5397b87e546347ad44097b5cd41b13dbadce9950087cbb

SHA512
a01e4b5390c064022f2650ff13fb2c3eeb78c2caf33bf99b8d0144acdc519ffcc3285b7d83df7dab42f21ffe17e84cf679bd9a0c09fa068369c16340303eecf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
Filesize
762KB

MD5
9537ab889e2a2fe1324af606ec24f91b

SHA1
a6d98cdea02597d1fb105b6c05c3616f0d535da2

SHA256
c2ca18c48e868a7c8e5397b87e546347ad44097b5cd41b13dbadce9950087cbb

SHA512
a01e4b5390c064022f2650ff13fb2c3eeb78c2caf33bf99b8d0144acdc519ffcc3285b7d83df7dab42f21ffe17e84cf679bd9a0c09fa068369c16340303eecf4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LFCZXUO0.txt
Filesize
603B

MD5
deaeb2458d8cea59386f20e8db036992

SHA1
e5fa35d6b4571c0fa23ad847380f6b85a340c01e

SHA256
79ceb906a5107ba9e3ddbb06b14b19176f06d06a92cdabbe4fc82a09533475de

SHA512
aedf0c9b064e19cf70f70e98cd8b1e5d340196ec9e92ed8cd9ba6bb93c3f1b94e8cdca165b8117a916e569dca54fd7953a84a511e6dde27f35cd40ae65479c76

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
Filesize
762KB

MD5
9537ab889e2a2fe1324af606ec24f91b

SHA1
a6d98cdea02597d1fb105b6c05c3616f0d535da2

SHA256
c2ca18c48e868a7c8e5397b87e546347ad44097b5cd41b13dbadce9950087cbb

SHA512
a01e4b5390c064022f2650ff13fb2c3eeb78c2caf33bf99b8d0144acdc519ffcc3285b7d83df7dab42f21ffe17e84cf679bd9a0c09fa068369c16340303eecf4

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
Filesize
762KB

MD5
9537ab889e2a2fe1324af606ec24f91b

SHA1
a6d98cdea02597d1fb105b6c05c3616f0d535da2

SHA256
c2ca18c48e868a7c8e5397b87e546347ad44097b5cd41b13dbadce9950087cbb

SHA512
a01e4b5390c064022f2650ff13fb2c3eeb78c2caf33bf99b8d0144acdc519ffcc3285b7d83df7dab42f21ffe17e84cf679bd9a0c09fa068369c16340303eecf4

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
Filesize
762KB

MD5
9537ab889e2a2fe1324af606ec24f91b

SHA1
a6d98cdea02597d1fb105b6c05c3616f0d535da2

SHA256
c2ca18c48e868a7c8e5397b87e546347ad44097b5cd41b13dbadce9950087cbb

SHA512
a01e4b5390c064022f2650ff13fb2c3eeb78c2caf33bf99b8d0144acdc519ffcc3285b7d83df7dab42f21ffe17e84cf679bd9a0c09fa068369c16340303eecf4

Download Submit
memory/836-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/836-62-0x00000000006F0000-0x00000000007B0000-memory.dmp

Filesize
768KB

Download
memory/1912-57-0x0000000000000000-mapping.dmp

Download
memory/1912-63-0x0000000000400000-0x00000000004BF600-memory.dmp

Filesize
765KB

Download
memory/1912-64-0x0000000000400000-0x00000000004BF600-memory.dmp

Filesize
765KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads