modiloader | 9b5bb5111e2297afc18c04990c7588f730f9d17a69bb748ed823c0074bdb04aa

General

Target

vertical_online.exe
Size

2.7MB
MD5

f2f45925b2c371ef661f066bb03cbfad
SHA1

bc10317c07e6ff8a2d4aef1f9dbddc67a90de40f
SHA256

9b5bb5111e2297afc18c04990c7588f730f9d17a69bb748ed823c0074bdb04aa
SHA512

522f6644f81b5d7b748f3f3afaf789b4af29fa05b64e1f49e68179b0d943717fec4bcc228cb5c08bb6ca436f565977f38aceb935965d2d9dcfe4ca5644c9c723
SSDEEP

49152:bqeNVfcqZIcKopG2vPhP9cfImP+HT4pnh+EhL7oG6WhpGJ0YF1I8P7Jop40jpv6f:WEa47KopbxP96RP+z4phDL0G6WPYo8Cx

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

Processes:

resource	yara_rule
\netfincas\netfincas\verticalonline.exe	modiloader_stage1
\netfincas\netfincas\verticalonline.exe	modiloader_stage1

Executes dropped EXE 1 IoCs

Processes:

vertical_online.tmp

pid process

844 vertical_online.tmp
Loads dropped DLL 3 IoCs

Processes:

vertical_online.exevertical_online.tmp

pid process

1952 vertical_online.exe
844 vertical_online.tmp
844 vertical_online.tmp
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vertical_online.tmp

pid process

844 vertical_online.tmp
844 vertical_online.tmp
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

vertical_online.tmp

pid process

844 vertical_online.tmp

pid	process
844	vertical_online.tmp

pid	process
1952	vertical_online.exe
844	vertical_online.tmp
844	vertical_online.tmp

pid	process
844	vertical_online.tmp
844	vertical_online.tmp

pid	process
844	vertical_online.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

vertical_online.exe

description	pid	process	target process
PID 1952 wrote to memory of 844	1952	vertical_online.exe	vertical_online.tmp
PID 1952 wrote to memory of 844	1952	vertical_online.exe	vertical_online.tmp
PID 1952 wrote to memory of 844	1952	vertical_online.exe	vertical_online.tmp
PID 1952 wrote to memory of 844	1952	vertical_online.exe	vertical_online.tmp
PID 1952 wrote to memory of 844	1952	vertical_online.exe	vertical_online.tmp
PID 1952 wrote to memory of 844	1952	vertical_online.exe	vertical_online.tmp
PID 1952 wrote to memory of 844	1952	vertical_online.exe	vertical_online.tmp

C:\Users\Admin\AppData\Local\Temp\vertical_online.exe
"C:\Users\Admin\AppData\Local\Temp\vertical_online.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\is-CANVT.tmp\vertical_online.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CANVT.tmp\vertical_online.tmp" /SL5="$9012A,2088647,780800,C:\Users\Admin\AppData\Local\Temp\vertical_online.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-CANVT.tmp\vertical_online.tmp

Filesize
2.5MB

MD5
05d61f86d9e9de5061fcf2011795a8d9

SHA1
0907db26d8d70b893453e6fd8b8d28aaed708040

SHA256
ac4bf2cafdb6204bf70a50bb458a26aab74d8651ea57d88fc71608ca7ebe1a07

SHA512
db00eef80c4c71fe1979265410f55706b6a216300f6d9e26e1873952feafc4bf03b10c1c129d19e2e91f572362ac19785933f099542cd18475a587a2f082c6e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CANVT.tmp\vertical_online.tmp

Filesize
2.5MB

MD5
05d61f86d9e9de5061fcf2011795a8d9

SHA1
0907db26d8d70b893453e6fd8b8d28aaed708040

SHA256
ac4bf2cafdb6204bf70a50bb458a26aab74d8651ea57d88fc71608ca7ebe1a07

SHA512
db00eef80c4c71fe1979265410f55706b6a216300f6d9e26e1873952feafc4bf03b10c1c129d19e2e91f572362ac19785933f099542cd18475a587a2f082c6e2

Download Submit
\Users\Admin\AppData\Local\Temp\is-CANVT.tmp\vertical_online.tmp

Filesize
2.5MB

MD5
05d61f86d9e9de5061fcf2011795a8d9

SHA1
0907db26d8d70b893453e6fd8b8d28aaed708040

SHA256
ac4bf2cafdb6204bf70a50bb458a26aab74d8651ea57d88fc71608ca7ebe1a07

SHA512
db00eef80c4c71fe1979265410f55706b6a216300f6d9e26e1873952feafc4bf03b10c1c129d19e2e91f572362ac19785933f099542cd18475a587a2f082c6e2

Download Submit
\netfincas\netfincas\verticalonline.exe

Filesize
1.9MB

MD5
b0c81e267d6cd96a5b74336ce62a0186

SHA1
30a5f0c54b20b4885f1488c87c65ffd607cb1a05

SHA256
c523c36fdb1f0d2725e3295dd1d6e19bdcb99fda5814b434a8c935f6f4482ba7

SHA512
7d38f9149f188f8c9a51622ebede2da79888cb2ce4dc121b4422fe231e0ba567028c8b61587115d3050fed584c4ce87ddaeb5a667b8f706fd399ea9ef9cdd920

Download Submit
\netfincas\netfincas\verticalonline.exe

Filesize
1.9MB

MD5
b0c81e267d6cd96a5b74336ce62a0186

SHA1
30a5f0c54b20b4885f1488c87c65ffd607cb1a05

SHA256
c523c36fdb1f0d2725e3295dd1d6e19bdcb99fda5814b434a8c935f6f4482ba7

SHA512
7d38f9149f188f8c9a51622ebede2da79888cb2ce4dc121b4422fe231e0ba567028c8b61587115d3050fed584c4ce87ddaeb5a667b8f706fd399ea9ef9cdd920

Download Submit
memory/844-58-0x0000000000000000-mapping.dmp

Download
memory/844-62-0x0000000074471000-0x0000000074473000-memory.dmp

Filesize
8KB

Download
memory/1952-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1952-55-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1952-60-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1952-66-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download

Analysis

Sharing