modiloader | 1ca9a78c794861c21817bf7c4cd1b903bfb3ce4c64d2f6daf3ef4606775b6efc

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2023, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Hqtxxjpjckxave.exe
Size

743KB
MD5

94b1f0ce6e3425e8461b1ed3fd9f0439
SHA1

8912717e3164a6c74eaa24a2318c662320e4783a
SHA256

1ca9a78c794861c21817bf7c4cd1b903bfb3ce4c64d2f6daf3ef4606775b6efc
SHA512

b1878ca9493d2f2a7933dbca470b10a9a219acaa3b5cc34c8dd39f81937a5e1dd004c9c3d32aad26b1470f5238e1861af879c8c30291b46ced9db68fab882e38
SSDEEP

12288:QVxfM/PNmfig4qXnWy1ZsY2mTS7gazVb8N0K1WqLjPGb:0iEfB4Q9+VIECjP

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4504-134-0x0000000002290000-0x00000000022C2000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hqtxxjpj = "C:\\Users\\Public\\Libraries\\jpjxxtqH.url"	Hqtxxjpjckxave.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3876 set thread context of 3144	3876	SndVol.exe	36
PID 3636 set thread context of 3144	3636	help.exe	36

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4772	744	WerFault.exe	93

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	help.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
3876	SndVol.exe
3876	SndVol.exe
3876	SndVol.exe
3876	SndVol.exe
3876	SndVol.exe
3876	SndVol.exe
3876	SndVol.exe
3876	SndVol.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3144	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3876	SndVol.exe
3876	SndVol.exe
3876	SndVol.exe
3636	help.exe
3636	help.exe
3636	help.exe
3636	help.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	SndVol.exe
Token: SeDebugPrivilege	3636	help.exe
Token: SeShutdownPrivilege	3144	Explorer.EXE
Token: SeCreatePagefilePrivilege	3144	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3876	4504	Hqtxxjpjckxave.exe	90
PID 4504 wrote to memory of 3876	4504	Hqtxxjpjckxave.exe	90
PID 4504 wrote to memory of 3876	4504	Hqtxxjpjckxave.exe	90
PID 4504 wrote to memory of 3876	4504	Hqtxxjpjckxave.exe	90
PID 4504 wrote to memory of 3876	4504	Hqtxxjpjckxave.exe	90
PID 4504 wrote to memory of 3876	4504	Hqtxxjpjckxave.exe	90
PID 3144 wrote to memory of 3636	3144	Explorer.EXE	91
PID 3144 wrote to memory of 3636	3144	Explorer.EXE	91
PID 3144 wrote to memory of 3636	3144	Explorer.EXE	91
PID 3636 wrote to memory of 744	3636	help.exe	93
PID 3636 wrote to memory of 744	3636	help.exe	93
PID 3636 wrote to memory of 744	3636	help.exe	93

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\Hqtxxjpjckxave.exe
  "C:\Users\Admin\AppData\Local\Temp\Hqtxxjpjckxave.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\SndVol.exe
    "C:\Windows\System32\SndVol.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:744
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 744 -s 156
      4⤵
      Program crash
      PID:4772

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 744 -ip 744
1⤵
PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-148-0x0000000003170000-0x0000000003221000-memory.dmp

Filesize
708KB

Download
memory/3144-162-0x00000000089F0000-0x0000000008A83000-memory.dmp

Filesize
588KB

Download
memory/3144-155-0x00000000089F0000-0x0000000008A83000-memory.dmp

Filesize
588KB

Download
memory/3636-154-0x00000000012E0000-0x000000000136F000-memory.dmp

Filesize
572KB

Download
memory/3636-153-0x0000000001400000-0x000000000174A000-memory.dmp

Filesize
3.3MB

Download
memory/3636-152-0x0000000000BA0000-0x0000000000BCD000-memory.dmp

Filesize
180KB

Download
memory/3636-150-0x00000000006A0000-0x00000000006A7000-memory.dmp

Filesize
28KB

Download
memory/3636-149-0x00000000006A0000-0x00000000006A7000-memory.dmp

Filesize
28KB

Download
memory/3876-146-0x0000000002F50000-0x000000000329A000-memory.dmp

Filesize
3.3MB

Download
memory/3876-147-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Filesize
64KB

Download
memory/3876-145-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/3876-144-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/3876-142-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/4504-133-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4504-141-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/4504-140-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/4504-136-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4504-134-0x0000000002290000-0x00000000022C2000-memory.dmp

Filesize
200KB

Download