modiloader | e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846

Resubmissions

28-04-2023 10:24

230428-mffepsfc5y 10

28-04-2023 10:20

230428-mdklmsdc49 10

Analysis

max time kernel
132s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2023 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe
Size

876KB
MD5

69fa88e706912bcfa3dc9cc07626c662
SHA1

3daaf1e070049dce9b621d48addcabe97150bdac
SHA256

e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846
SHA512

0e3c6ff3e5ab31a3c454b5df4c9e12aa2ae77e1e0c50bf7911a3c34b197ba3fd2b282ce9ee94e7228f8b772ae436c08266078d0720d948b6ac2f52d8d70918ef
SSDEEP

24576:NLX89GZ9NaJlSs0+w6nm2g5+zTwzwK30JV:NLs4mDSa6zPmV

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/940-133-0x00000000023F0000-0x0000000002449000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qlbvm = "C:\\Users\\Public\\Libraries\\mvblQ.url"	e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe

pid	process
940	e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe
940	e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe

description	pid	process	target process
PID 940 wrote to memory of 3592	940	e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe	wscript.exe
PID 940 wrote to memory of 3592	940	e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe	wscript.exe
PID 940 wrote to memory of 3592	940	e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe	wscript.exe

C:\Users\Admin\AppData\Local\Temp\e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe
"C:\Users\Admin\AppData\Local\Temp\e06f360ca8f64621bf34e248da434adc6b65391e196bc9cb0a62a00baa134846.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\wscript.exe
C:\Windows\System32\wscript.exe
2⤵
PID:3592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-133-0x00000000023F0000-0x0000000002449000-memory.dmp

Filesize
356KB

Download
memory/940-135-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/940-136-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/940-140-0x0000000030410000-0x000000003043F000-memory.dmp

Filesize
188KB

Download
memory/940-141-0x0000000030410000-0x000000003043F000-memory.dmp

Filesize
188KB

Download