modiloader | b4d144db0a51b75fec768e08ec6500afd3b085c0a9dd9b22926845536ec2a50d

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-04-2023 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
Size

1.4MB
MD5

ebbf1477570f9b7acccac1946a9a2099
SHA1

21b54ad89f6c5fcba305a586efc746b4f32bf1c3
SHA256

b4d144db0a51b75fec768e08ec6500afd3b085c0a9dd9b22926845536ec2a50d
SHA512

108db6d635c07c61222813518168216eef7b5669afed0cf65485bc28d72de92bb55258b032e3cbca474ce790cf0884c3d6689e17c2b744448fa840a9f613e26c
SSDEEP

24576:QzhCv4xm8E+fEc6tkt2SAaQ5/m9Qr/aZLkaf1mPqGyHvzU+XowdTH:QzZwaQ5/bx/+rXo4

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1636-54-0x0000000003490000-0x0000000003577000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zqsozefb = "C:\\Users\\Public\\Libraries\\bfezosqZ.url"	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

pid process

1636 Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

pid	process
1636	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe

description	pid	process	target process
PID 1636 wrote to memory of 268	1636	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 1636 wrote to memory of 268	1636	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 1636 wrote to memory of 268	1636	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe
PID 1636 wrote to memory of 268	1636	Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe	wscript.exe

C:\Users\Admin\AppData\Local\Temp\Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe
"C:\Users\Admin\AppData\Local\Temp\Pekao_Potwierdzenie przelewu platnosci_PL3000065000342790.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\wscript.exe
C:\Windows\System32\wscript.exe
2⤵
PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-54-0x0000000003490000-0x0000000003577000-memory.dmp

Filesize
924KB

Download
memory/1636-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1636-57-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/1636-60-0x0000000030590000-0x000000003064F000-memory.dmp

Filesize
764KB

Download
memory/1636-61-0x0000000030590000-0x000000003064F000-memory.dmp

Filesize
764KB

Download