modiloader | fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7

General

Target

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
Size

294KB
MD5

89da76169490fb0e4e98ca30bc08070c
SHA1

98e1fc22ad373dd9e166cf0dd5c26de936d8eabb
SHA256

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7
SHA512

132779b0e1f91fc62513db49a11778df8a3dba70543892f41cc711cac6912be609b9a3729991be8affe0b1f2b210765b160109b0b125ddad7639d05060853041
SSDEEP

6144:y4hl4JcuLhAbjBf072CrmtbKBGGzvHPNGw1w0aaIIAJyXsewI+Jz0:yQl4CuLmxf0SCit2BrzPPN+0avhyXVw+

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1944-55-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2
behavioral1/memory/1588-64-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2
behavioral1/memory/1588-67-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2
behavioral1/memory/1944-69-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

winlogin.exe

pid process

1588 winlogin.exe

pid	process
1588	winlogin.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1944-55-0x0000000000400000-0x00000000004C3000-memory.dmp	upx
\Program Files\Common Files\Microsoft Shared\MSInfo\winlogin.exe	upx
\Program Files\Common Files\Microsoft Shared\MSInfo\winlogin.exe	upx
C:\Program Files\Common Files\Microsoft Shared\MSInfo\winlogin.exe	upx
C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe	upx
behavioral1/memory/1588-64-0x0000000000400000-0x00000000004C3000-memory.dmp	upx
behavioral1/memory/616-65-0x0000000000400000-0x00000000004C3000-memory.dmp	upx
behavioral1/memory/1588-67-0x0000000000400000-0x00000000004C3000-memory.dmp	upx
behavioral1/memory/1944-69-0x0000000000400000-0x00000000004C3000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1356 cmd.exe

pid	process
1356	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

pid	process
1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

description	ioc	process
File opened (read-only)	\??\B:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\E:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\I:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\L:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\M:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\P:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\T:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\Y:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\Z:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\J:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\N:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\Q:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\R:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\S:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\X:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\O:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\V:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\A:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\F:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\G:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\H:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\K:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\U:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\W:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

description	ioc	process
File created	C:\AutoRun.inf	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened for modification	C:\AutoRun.inf	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

winlogin.exe

description pid process target process

PID 1588 set thread context of 616 1588 winlogin.exe calc.exe

description	pid	process	target process
PID 1588 set thread context of 616	1588	winlogin.exe	calc.exe

Drops file in Program Files directory 5 IoCs

Processes:

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exewinlogin.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\_winlogin.exe	winlogin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\_winlogin.exe	winlogin.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelStr.bat	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exewinlogin.exe

description	pid	process	target process
PID 1944 wrote to memory of 1588	1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	winlogin.exe
PID 1944 wrote to memory of 1588	1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	winlogin.exe
PID 1944 wrote to memory of 1588	1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	winlogin.exe
PID 1944 wrote to memory of 1588	1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	winlogin.exe
PID 1588 wrote to memory of 616	1588	winlogin.exe	calc.exe
PID 1588 wrote to memory of 616	1588	winlogin.exe	calc.exe
PID 1588 wrote to memory of 616	1588	winlogin.exe	calc.exe
PID 1588 wrote to memory of 616	1588	winlogin.exe	calc.exe
PID 1588 wrote to memory of 616	1588	winlogin.exe	calc.exe
PID 1588 wrote to memory of 616	1588	winlogin.exe	calc.exe
PID 1588 wrote to memory of 1368	1588	winlogin.exe	IEXPLORE.EXE
PID 1588 wrote to memory of 1368	1588	winlogin.exe	IEXPLORE.EXE
PID 1588 wrote to memory of 1368	1588	winlogin.exe	IEXPLORE.EXE
PID 1588 wrote to memory of 1368	1588	winlogin.exe	IEXPLORE.EXE
PID 1944 wrote to memory of 1356	1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	cmd.exe
PID 1944 wrote to memory of 1356	1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	cmd.exe
PID 1944 wrote to memory of 1356	1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	cmd.exe
PID 1944 wrote to memory of 1356	1944	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
"C:\Users\Admin\AppData\Local\Temp\fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:616
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelStr.bat""
  2⤵
  - Deletes itself
  PID:1356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelStr.bat

Filesize
248B

MD5
c5ecfde6f1eea991a51b7a62384dc95b

SHA1
349def848140465c2e326d45a8e87544d01c93fc

SHA256
08e7154ea8c39c29c5bcf100d2927cccbc56ce0e2bf0a6b7e13c8dcc60ef8e8a

SHA512
7d8828cfd6dd3bca84d425d9abb57f69c05cb6a52b26edcc16a5fdf7d7985bbc93261bedd923568329e05e7f1c518b443382ee3f664dae47ea2caefdfd40766d

Download Submit
C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe

Filesize
294KB

MD5
89da76169490fb0e4e98ca30bc08070c

SHA1
98e1fc22ad373dd9e166cf0dd5c26de936d8eabb

SHA256
fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7

SHA512
132779b0e1f91fc62513db49a11778df8a3dba70543892f41cc711cac6912be609b9a3729991be8affe0b1f2b210765b160109b0b125ddad7639d05060853041

Download Submit
C:\Program Files\Common Files\Microsoft Shared\MSInfo\winlogin.exe

Filesize
294KB

MD5
89da76169490fb0e4e98ca30bc08070c

SHA1
98e1fc22ad373dd9e166cf0dd5c26de936d8eabb

SHA256
fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7

SHA512
132779b0e1f91fc62513db49a11778df8a3dba70543892f41cc711cac6912be609b9a3729991be8affe0b1f2b210765b160109b0b125ddad7639d05060853041

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\winlogin.exe

Filesize
294KB

MD5
89da76169490fb0e4e98ca30bc08070c

SHA1
98e1fc22ad373dd9e166cf0dd5c26de936d8eabb

SHA256
fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7

SHA512
132779b0e1f91fc62513db49a11778df8a3dba70543892f41cc711cac6912be609b9a3729991be8affe0b1f2b210765b160109b0b125ddad7639d05060853041

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\winlogin.exe

Filesize
294KB

MD5
89da76169490fb0e4e98ca30bc08070c

SHA1
98e1fc22ad373dd9e166cf0dd5c26de936d8eabb

SHA256
fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7

SHA512
132779b0e1f91fc62513db49a11778df8a3dba70543892f41cc711cac6912be609b9a3729991be8affe0b1f2b210765b160109b0b125ddad7639d05060853041

Download Submit
memory/616-65-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/616-62-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/616-66-0x00000000004C0850-mapping.dmp

Download
memory/1356-68-0x0000000000000000-mapping.dmp

Download
memory/1588-58-0x0000000000000000-mapping.dmp

Download
memory/1588-64-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1588-67-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1944-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1944-69-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1944-55-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads