modiloader | f94be5630497d64da51b0a362279b6a60133365e60e27bbbc90f7767faed4f28

General

Target

Order confirmation is attached.exe
Size

769KB
MD5

64ce92242a4b896e952c57d6e8144bd4
SHA1

167cf3fe9a09072bc3abe8d0ff957217201cfc63
SHA256

f94be5630497d64da51b0a362279b6a60133365e60e27bbbc90f7767faed4f28
SHA512

94636fca9f8b94295b49b53d85aad3ddf8f1916ab7376e6a504a28a316ac4f4b8a6d5ebc1b8fdf0e12a432d55f44340907bdada29f8599e921026b5f201a33df
SSDEEP

12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNQhnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeW+zhxN2rn4P

Score

10^/10

modiloader persistence spyware stealer trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4408-133-0x0000000003FA0000-0x0000000003FDE000-memory.dmp	modiloader_stage2

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

79 1792 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
79	1792	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Order confirmation is attached.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Anesehsg = "C:\\Users\\Public\\Libraries\\gshesenA.url"	Order confirmation is attached.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

colorcpl.exerundll32.exe

description	pid	process	target process
PID 2428 set thread context of 1384	2428	colorcpl.exe	Explorer.EXE
PID 1792 set thread context of 1384	1792	rundll32.exe	Explorer.EXE

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4944 4176 WerFault.exe Firefox.exe

pid	pid_target	process	target process
4944	4176	WerFault.exe	Firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	rundll32.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

Order confirmation is attached.execolorcpl.exerundll32.exe

pid	process
4408	Order confirmation is attached.exe
4408	Order confirmation is attached.exe
2428	colorcpl.exe
2428	colorcpl.exe
2428	colorcpl.exe
2428	colorcpl.exe
2428	colorcpl.exe
2428	colorcpl.exe
2428	colorcpl.exe
2428	colorcpl.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1384 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

colorcpl.exerundll32.exe

pid process

2428 colorcpl.exe
2428 colorcpl.exe
2428 colorcpl.exe
1792 rundll32.exe
1792 rundll32.exe
1792 rundll32.exe
1792 rundll32.exe

pid	process
1384	Explorer.EXE

pid	process
2428	colorcpl.exe
2428	colorcpl.exe
2428	colorcpl.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

colorcpl.exeExplorer.EXErundll32.exe

description	pid	process
Token: SeDebugPrivilege	2428	colorcpl.exe
Token: SeShutdownPrivilege	1384	Explorer.EXE
Token: SeCreatePagefilePrivilege	1384	Explorer.EXE
Token: SeShutdownPrivilege	1384	Explorer.EXE
Token: SeCreatePagefilePrivilege	1384	Explorer.EXE
Token: SeDebugPrivilege	1792	rundll32.exe
Token: SeShutdownPrivilege	1384	Explorer.EXE
Token: SeCreatePagefilePrivilege	1384	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Order confirmation is attached.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 4408 wrote to memory of 2428	4408	Order confirmation is attached.exe	colorcpl.exe
PID 4408 wrote to memory of 2428	4408	Order confirmation is attached.exe	colorcpl.exe
PID 4408 wrote to memory of 2428	4408	Order confirmation is attached.exe	colorcpl.exe
PID 4408 wrote to memory of 2428	4408	Order confirmation is attached.exe	colorcpl.exe
PID 4408 wrote to memory of 2428	4408	Order confirmation is attached.exe	colorcpl.exe
PID 4408 wrote to memory of 2428	4408	Order confirmation is attached.exe	colorcpl.exe
PID 1384 wrote to memory of 1792	1384	Explorer.EXE	rundll32.exe
PID 1384 wrote to memory of 1792	1384	Explorer.EXE	rundll32.exe
PID 1384 wrote to memory of 1792	1384	Explorer.EXE	rundll32.exe
PID 1792 wrote to memory of 4176	1792	rundll32.exe	Firefox.exe
PID 1792 wrote to memory of 4176	1792	rundll32.exe	Firefox.exe
PID 1792 wrote to memory of 4176	1792	rundll32.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\Order confirmation is attached.exe
  "C:\Users\Admin\AppData\Local\Temp\Order confirmation is attached.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\System32\colorcpl.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4176
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4176 -s 116
      4⤵
      Program crash
      PID:4944

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 4176 -ip 4176
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-157-0x0000000007FA0000-0x0000000008091000-memory.dmp

Filesize
964KB

Download
memory/1384-170-0x0000000008180000-0x0000000008289000-memory.dmp

Filesize
1.0MB

Download
memory/1384-168-0x0000000008180000-0x0000000008289000-memory.dmp

Filesize
1.0MB

Download
memory/1384-167-0x0000000008180000-0x0000000008289000-memory.dmp

Filesize
1.0MB

Download
memory/1792-164-0x0000000000380000-0x00000000003AD000-memory.dmp

Filesize
180KB

Download
memory/1792-163-0x0000000002430000-0x000000000277A000-memory.dmp

Filesize
3.3MB

Download
memory/1792-166-0x0000000002280000-0x000000000230F000-memory.dmp

Filesize
572KB

Download
memory/1792-162-0x0000000000380000-0x00000000003AD000-memory.dmp

Filesize
180KB

Download
memory/1792-161-0x00000000001B0000-0x00000000001C4000-memory.dmp

Filesize
80KB

Download
memory/1792-159-0x00000000001B0000-0x00000000001C4000-memory.dmp

Filesize
80KB

Download
memory/2428-155-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/2428-156-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/2428-154-0x00000000053E0000-0x000000000572A000-memory.dmp

Filesize
3.3MB

Download
memory/2428-151-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/2428-153-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/4408-150-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/4408-133-0x0000000003FA0000-0x0000000003FDE000-memory.dmp

Filesize
248KB

Download
memory/4408-149-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/4408-136-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/4408-134-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads