modiloader | f334d177546cec1c77a515b15641ded5051b350c1a4441d28d7a45a0c709d6aa

Analysis

max time kernel
331s
max time network
331s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-05-2023 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cheat_SAMP.exe
Size

397KB
MD5

c0f64b710727e5d1037535100a9ccc0a
SHA1

45e05788d1d25b03c44eb82242d8574b72f7b6a0
SHA256

f334d177546cec1c77a515b15641ded5051b350c1a4441d28d7a45a0c709d6aa
SHA512

45d36ec27a4e0cbe8f752880097ed992fd1ea64d4e3093942660fd4e089e2016670e37e5894c88d5bd6bcb7d0e8b25776e54126fa093509f9f013fbea65bfb23
SSDEEP

6144:cLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXVkP:I+u9nx2GjMY3XKfd/H/9PuP

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/920-55-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cheat_SAMP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run	cheat_SAMP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\cheat_SAMP.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat_SAMP.exe"	cheat_SAMP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cheat_SAMP.exe

pid	process
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe
920	cheat_SAMP.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

cheat_SAMP.exe

pid process

920 cheat_SAMP.exe

C:\Users\Admin\AppData\Local\Temp\cheat_SAMP.exe
"C:\Users\Admin\AppData\Local\Temp\cheat_SAMP.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:920

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/920-55-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download