modiloader | 52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377

General

Target

52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe
Size

87KB
MD5

5fd00fadfdb282fa9a4a927bf8946c63
SHA1

43e6c2e52509e389bc5f9956bb4b18635c8678a8
SHA256

52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377
SHA512

d9015a44b8e77a93a7e20b1c9db109be2c48b68244bc94a131830cfb3ae71d2a6918d08bb7917154bfa488ae0c5e94426a634814a9d146d0db72972ad10bb2f5
SSDEEP

1536:Mhw5N9SkHFo+UuJr905DtMm/YMwS5NzwPseo4182n19h1n3Kucrs4yR4FAyhTLV6:35DUUJ0om/YC5NMPS+8yh5qs7mOyh96

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1988-60-0x0000000000400000-0x000000000042E000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-64-0x0000000000400000-0x000000000042E000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-65-0x0000000000400000-0x000000000042E000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

Microsoft.exe

pid process

2008 Microsoft.exe

pid	process
2008	Microsoft.exe

Loads dropped DLL 2 IoCs

Processes:

52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe

pid	process
1988	52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe
1988	52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Microsoft.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft.exe"	Microsoft.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe

description	pid	process	target process
PID 1988 wrote to memory of 2008	1988	52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe	Microsoft.exe
PID 1988 wrote to memory of 2008	1988	52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe	Microsoft.exe
PID 1988 wrote to memory of 2008	1988	52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe	Microsoft.exe
PID 1988 wrote to memory of 2008	1988	52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe	Microsoft.exe

C:\Users\Admin\AppData\Local\Temp\52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe
"C:\Users\Admin\AppData\Local\Temp\52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Roaming\Microsoft.exe
"C:\Users\Admin\AppData\Roaming\Microsoft.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft.exe
Filesize
87KB

MD5
5fd00fadfdb282fa9a4a927bf8946c63

SHA1
43e6c2e52509e389bc5f9956bb4b18635c8678a8

SHA256
52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377

SHA512
d9015a44b8e77a93a7e20b1c9db109be2c48b68244bc94a131830cfb3ae71d2a6918d08bb7917154bfa488ae0c5e94426a634814a9d146d0db72972ad10bb2f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft.exe
Filesize
87KB

MD5
5fd00fadfdb282fa9a4a927bf8946c63

SHA1
43e6c2e52509e389bc5f9956bb4b18635c8678a8

SHA256
52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377

SHA512
d9015a44b8e77a93a7e20b1c9db109be2c48b68244bc94a131830cfb3ae71d2a6918d08bb7917154bfa488ae0c5e94426a634814a9d146d0db72972ad10bb2f5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft.exe
Filesize
87KB

MD5
5fd00fadfdb282fa9a4a927bf8946c63

SHA1
43e6c2e52509e389bc5f9956bb4b18635c8678a8

SHA256
52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377

SHA512
d9015a44b8e77a93a7e20b1c9db109be2c48b68244bc94a131830cfb3ae71d2a6918d08bb7917154bfa488ae0c5e94426a634814a9d146d0db72972ad10bb2f5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft.exe
Filesize
87KB

MD5
5fd00fadfdb282fa9a4a927bf8946c63

SHA1
43e6c2e52509e389bc5f9956bb4b18635c8678a8

SHA256
52a331c2a4d440b14fff60d2e3215544a6020aa129484bfee39a37131b46a377

SHA512
d9015a44b8e77a93a7e20b1c9db109be2c48b68244bc94a131830cfb3ae71d2a6918d08bb7917154bfa488ae0c5e94426a634814a9d146d0db72972ad10bb2f5

Download Submit
memory/1988-54-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1988-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/1988-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2008-58-0x0000000000000000-mapping.dmp

Download
memory/2008-62-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2008-64-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2008-65-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads