modiloader | 8e3dad0209d9f2d4213d7311f332bedb634fc52273e75c72bfb7348cadbbb03e

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2023 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03418699.exe
Size

1.0MB
MD5

c71facef94fb0c33e17f3b27f7495606
SHA1

03148b78a420112b1a13134bcc6a2972e5cb5656
SHA256

8e3dad0209d9f2d4213d7311f332bedb634fc52273e75c72bfb7348cadbbb03e
SHA512

4859402e218ec082b565c29ef3d78aa631383c6df5eec4e5081b12f0703cc3c22d855c869ad669942d258ce6fb5145524a1cf3ab4ad96ae4d25fe29d6f5aa9d6
SSDEEP

24576:H7WYeFPVGe9lsxrcghJ/Anv8YccL7RVK9k57kl33kgX6ICyPM6v:Vwsv/AnXcoK9kOkC2ybv

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/files/0x000200000001f747-154.dat	modiloader_stage2
behavioral2/files/0x000200000001f747-156.dat	modiloader_stage2
behavioral2/memory/4312-158-0x0000000000400000-0x0000000000554000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	03418699.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	antivirus.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C:\ProgramData\antivirus\antivirus.exe\appbeer.lnk	03418699.exe

Executes dropped EXE 2 IoCs

pid	Process
312	antivirus.exe
4312	scann.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 312	1648	03418699.exe	86
PID 1648 wrote to memory of 312	1648	03418699.exe	86
PID 1648 wrote to memory of 312	1648	03418699.exe	86
PID 312 wrote to memory of 4312	312	antivirus.exe	89
PID 312 wrote to memory of 4312	312	antivirus.exe	89
PID 312 wrote to memory of 4312	312	antivirus.exe	89

C:\Users\Admin\AppData\Local\Temp\03418699.exe
"C:\Users\Admin\AppData\Local\Temp\03418699.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1648
- C:\ProgramData\antivirus\antivirus.exe
  "C:\ProgramData\antivirus\antivirus.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\ProgramData\antivirus\scann.exe
    "C:\ProgramData\antivirus\scann.exe"
    3⤵
    - Executes dropped EXE
    PID:4312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\antivirus\antivirus.exe

Filesize
21KB

MD5
7fd8a7f7ffafad5892a16b410f4821ca

SHA1
b0f2b80891a16f8acf1034eb636172db7e024c21

SHA256
7b287a487eb46c678335490146e9e413704042a66215c952e8924c77164eb8ec

SHA512
fd1bc2c3eaf08137b612737d70121407bac68e910ae91d465afe218074f1c0aa5b7515aed5c3f5ba7f4c1091a6f0e3e88b67720083c77f6f8adf6ef985110f45

Download Submit
C:\ProgramData\antivirus\antivirus.exe

Filesize
21KB

MD5
7fd8a7f7ffafad5892a16b410f4821ca

SHA1
b0f2b80891a16f8acf1034eb636172db7e024c21

SHA256
7b287a487eb46c678335490146e9e413704042a66215c952e8924c77164eb8ec

SHA512
fd1bc2c3eaf08137b612737d70121407bac68e910ae91d465afe218074f1c0aa5b7515aed5c3f5ba7f4c1091a6f0e3e88b67720083c77f6f8adf6ef985110f45

Download Submit
C:\ProgramData\antivirus\antivirus.exe

Filesize
21KB

MD5
7fd8a7f7ffafad5892a16b410f4821ca

SHA1
b0f2b80891a16f8acf1034eb636172db7e024c21

SHA256
7b287a487eb46c678335490146e9e413704042a66215c952e8924c77164eb8ec

SHA512
fd1bc2c3eaf08137b612737d70121407bac68e910ae91d465afe218074f1c0aa5b7515aed5c3f5ba7f4c1091a6f0e3e88b67720083c77f6f8adf6ef985110f45

Download Submit
C:\ProgramData\antivirus\scann.exe

Filesize
1.3MB

MD5
f0027594ee1d659e2429425cacb26e92

SHA1
a4c5b6d8e038d4be0e4fffd3a345472f2fec405c

SHA256
26441e29741e5fb3064ddff758e73cc969c97c1246bb276691b321380a63d42a

SHA512
ec2402c4700e98af19c18e7ce970349d5c748ad8f04dee16cf59faefbc192cd7ef786abea132bfc68624fa35d27d15a2622d6f5cb6e01ef2f3fe0ea350ecf2aa

Download Submit
C:\ProgramData\antivirus\scann.exe

Filesize
1.3MB

MD5
f0027594ee1d659e2429425cacb26e92

SHA1
a4c5b6d8e038d4be0e4fffd3a345472f2fec405c

SHA256
26441e29741e5fb3064ddff758e73cc969c97c1246bb276691b321380a63d42a

SHA512
ec2402c4700e98af19c18e7ce970349d5c748ad8f04dee16cf59faefbc192cd7ef786abea132bfc68624fa35d27d15a2622d6f5cb6e01ef2f3fe0ea350ecf2aa

Download Submit
memory/312-148-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/312-151-0x0000000004FB0000-0x0000000005042000-memory.dmp

Filesize
584KB

Download
memory/312-152-0x0000000004F40000-0x0000000004F4A000-memory.dmp

Filesize
40KB

Download
memory/312-153-0x00000000051F0000-0x0000000005246000-memory.dmp

Filesize
344KB

Download
memory/312-150-0x00000000054C0000-0x0000000005A64000-memory.dmp

Filesize
5.6MB

Download
memory/312-155-0x00000000050F0000-0x0000000005100000-memory.dmp

Filesize
64KB

Download
memory/312-149-0x0000000004E70000-0x0000000004F0C000-memory.dmp

Filesize
624KB

Download
memory/4312-158-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download