modiloader | 4b382c5497bb61b9cc4189101e9595a031f37db9fa712b61cdc4a60f59bff8b4

General

Target

Nova lista narudzbi.exe
Size

816KB
MD5

c913939da5213c631b70b06fa61eae28
SHA1

28d2f9a5f12be6d61b85f5a5d6187e01f0ae284c
SHA256

4b382c5497bb61b9cc4189101e9595a031f37db9fa712b61cdc4a60f59bff8b4
SHA512

271be8d2ed70e93b16ae7a68e72b93252b6e9164f53d286014e371e801a268d650f484e1a19c1afd85abbd68c8f4718c11dc0c2c19ca64e849434d10fb476e49
SSDEEP

12288:hvTirPykFC+EQpA7EOiidyVMmfP8DspvZFVphCF807ldv8gjwowEl52joHDL4wk:aPVFn/A7vsV/f6MvvV+maHN5RA

Score

10^/10

modiloader xloader euv4 loader persistence rat trojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euv4

Decoy

anniebapartments.com

hagenbicycles.com

herbalist101.com

southerncorrosion.net

kuechenpruefer.com

tajniezdrzi.quest

segurofunerarioar.com

boardsandbeamsdecor.com

alifdanismanlik.com

pkem.top

mddc.clinic

handejqr.com

crux-at.com

awp.email

hugsforbubbs.com

cielotherepy.com

turkcuyuz.com

teamidc.com

lankasirinspa.com

68135.online

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/568-132-0x0000000003040000-0x000000000306C000-memory.dmp	modiloader_stage2

Xloader payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/568-136-0x0000000010410000-0x0000000010439000-memory.dmp	xloader
behavioral2/memory/5044-138-0x0000000010410000-0x0000000010439000-memory.dmp	xloader
behavioral2/memory/4996-144-0x0000000000E00000-0x0000000000E29000-memory.dmp	xloader
behavioral2/memory/4996-149-0x0000000000E00000-0x0000000000E29000-memory.dmp	xloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Nova lista narudzbi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Whnuwjse = "C:\\Users\\Public\\Libraries\\esjwunhW.url"	Nova lista narudzbi.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

iexpress.execontrol.exe

description	pid	process	target process
PID 5044 set thread context of 3092	5044	iexpress.exe	Explorer.EXE
PID 4996 set thread context of 3092	4996	control.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

Nova lista narudzbi.exeiexpress.execontrol.exe

pid	process
568	Nova lista narudzbi.exe
568	Nova lista narudzbi.exe
5044	iexpress.exe
5044	iexpress.exe
5044	iexpress.exe
5044	iexpress.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe
4996	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3092 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

iexpress.execontrol.exe

pid process

5044 iexpress.exe
5044 iexpress.exe
5044 iexpress.exe
4996 control.exe
4996 control.exe

pid	process
3092	Explorer.EXE

pid	process
5044	iexpress.exe
5044	iexpress.exe
5044	iexpress.exe
4996	control.exe
4996	control.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

iexpress.exeExplorer.EXEcontrol.exe

description	pid	process
Token: SeDebugPrivilege	5044	iexpress.exe
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeDebugPrivilege	4996	control.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Nova lista narudzbi.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 568 wrote to memory of 5044	568	Nova lista narudzbi.exe	iexpress.exe
PID 568 wrote to memory of 5044	568	Nova lista narudzbi.exe	iexpress.exe
PID 568 wrote to memory of 5044	568	Nova lista narudzbi.exe	iexpress.exe
PID 568 wrote to memory of 5044	568	Nova lista narudzbi.exe	iexpress.exe
PID 568 wrote to memory of 5044	568	Nova lista narudzbi.exe	iexpress.exe
PID 568 wrote to memory of 5044	568	Nova lista narudzbi.exe	iexpress.exe
PID 3092 wrote to memory of 4996	3092	Explorer.EXE	control.exe
PID 3092 wrote to memory of 4996	3092	Explorer.EXE	control.exe
PID 3092 wrote to memory of 4996	3092	Explorer.EXE	control.exe
PID 4996 wrote to memory of 1368	4996	control.exe	cmd.exe
PID 4996 wrote to memory of 1368	4996	control.exe	cmd.exe
PID 4996 wrote to memory of 1368	4996	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092

C:\Users\Admin\AppData\Local\Temp\Nova lista narudzbi.exe
"C:\Users\Admin\AppData\Local\Temp\Nova lista narudzbi.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\iexpress.exe
C:\Windows\System32\iexpress.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\SysWOW64\iexpress.exe"
3⤵
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-135-0x0000000010410000-0x0000000010439000-memory.dmp

Filesize
164KB

Download
memory/568-136-0x0000000010410000-0x0000000010439000-memory.dmp

Filesize
164KB

Download
memory/568-132-0x0000000003040000-0x000000000306C000-memory.dmp

Filesize
176KB

Download
memory/1368-145-0x0000000000000000-mapping.dmp

Download
memory/3092-141-0x0000000008260000-0x00000000083F9000-memory.dmp

Filesize
1.6MB

Download
memory/3092-150-0x0000000007CD0000-0x0000000007D8E000-memory.dmp

Filesize
760KB

Download
memory/3092-148-0x0000000007CD0000-0x0000000007D8E000-memory.dmp

Filesize
760KB

Download
memory/4996-146-0x0000000002D70000-0x00000000030BA000-memory.dmp

Filesize
3.3MB

Download
memory/4996-142-0x0000000000000000-mapping.dmp

Download
memory/4996-143-0x0000000000AA0000-0x0000000000AC7000-memory.dmp

Filesize
156KB

Download
memory/4996-144-0x0000000000E00000-0x0000000000E29000-memory.dmp

Filesize
164KB

Download
memory/4996-147-0x0000000002BA0000-0x0000000002C30000-memory.dmp

Filesize
576KB

Download
memory/4996-149-0x0000000000E00000-0x0000000000E29000-memory.dmp

Filesize
164KB

Download
memory/5044-140-0x0000000003C00000-0x0000000003C11000-memory.dmp

Filesize
68KB

Download
memory/5044-139-0x0000000003C80000-0x0000000003FCA000-memory.dmp

Filesize
3.3MB

Download
memory/5044-138-0x0000000010410000-0x0000000010439000-memory.dmp

Filesize
164KB

Download
memory/5044-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads