modiloader | fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7

General

Target

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
Size

294KB
MD5

89da76169490fb0e4e98ca30bc08070c
SHA1

98e1fc22ad373dd9e166cf0dd5c26de936d8eabb
SHA256

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7
SHA512

132779b0e1f91fc62513db49a11778df8a3dba70543892f41cc711cac6912be609b9a3729991be8affe0b1f2b210765b160109b0b125ddad7639d05060853041
SSDEEP

6144:y4hl4JcuLhAbjBf072CrmtbKBGGzvHPNGw1w0aaIIAJyXsewI+Jz0:yQl4CuLmxf0SCit2BrzPPN+0avhyXVw+

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3464-132-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

winlogin.exe

pid process

4604 winlogin.exe

pid	process
4604	winlogin.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3464-132-0x0000000000400000-0x00000000004C3000-memory.dmp	upx
C:\Program Files\Common Files\microsoft shared\MSInfo\winlogin.exe	upx
C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe	upx

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

description	ioc	process
File opened (read-only)	\??\B:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\J:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\P:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\Q:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\R:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\W:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\Z:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\F:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\G:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\H:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\L:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\M:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\N:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\O:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\T:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\U:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\A:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\E:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\K:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\V:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\X:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\Y:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\I:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened (read-only)	\??\S:	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

description	ioc	process
File created	C:\AutoRun.inf	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened for modification	C:\AutoRun.inf	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

winlogin.exe

description pid process target process

PID 4604 set thread context of 4212 4604 winlogin.exe calc.exe

description	pid	process	target process
PID 4604 set thread context of 4212	4604	winlogin.exe	calc.exe

Drops file in Program Files directory 4 IoCs

Processes:

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exewinlogin.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\_winlogin.exe	winlogin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\_winlogin.exe	winlogin.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exewinlogin.exe

description	pid	process	target process
PID 3464 wrote to memory of 4604	3464	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	winlogin.exe
PID 3464 wrote to memory of 4604	3464	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	winlogin.exe
PID 3464 wrote to memory of 4604	3464	fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe	winlogin.exe
PID 4604 wrote to memory of 4212	4604	winlogin.exe	calc.exe
PID 4604 wrote to memory of 4212	4604	winlogin.exe	calc.exe
PID 4604 wrote to memory of 4212	4604	winlogin.exe	calc.exe
PID 4604 wrote to memory of 4212	4604	winlogin.exe	calc.exe
PID 4604 wrote to memory of 4212	4604	winlogin.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe
"C:\Users\Admin\AppData\Local\Temp\fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\winlogin.exe

Filesize
294KB

MD5
89da76169490fb0e4e98ca30bc08070c

SHA1
98e1fc22ad373dd9e166cf0dd5c26de936d8eabb

SHA256
fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7

SHA512
132779b0e1f91fc62513db49a11778df8a3dba70543892f41cc711cac6912be609b9a3729991be8affe0b1f2b210765b160109b0b125ddad7639d05060853041

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\winlogin.exe

Filesize
294KB

MD5
89da76169490fb0e4e98ca30bc08070c

SHA1
98e1fc22ad373dd9e166cf0dd5c26de936d8eabb

SHA256
fe6e5741d6c8da468acc0420ee07e93700feca6a3625f532a00b12d9e90accd7

SHA512
132779b0e1f91fc62513db49a11778df8a3dba70543892f41cc711cac6912be609b9a3729991be8affe0b1f2b210765b160109b0b125ddad7639d05060853041

Download Submit
memory/3464-132-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/4212-136-0x0000000000000000-mapping.dmp

Download
memory/4604-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads