modiloader | 545e53fd784db3a0227fcf431e81005c9f74ec6be1dcee9a1a2734fa103b6b27

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0063526252653123.exe
Size

899KB
MD5

3d4263db810fa459158027bde98c9acc
SHA1

6e14a2df3bd13d62be9de3463a05e7bd53319b7d
SHA256

545e53fd784db3a0227fcf431e81005c9f74ec6be1dcee9a1a2734fa103b6b27
SHA512

e1e82a6f3a9cb2dcbbd4f734b09b7ceab4df24b87bc5a1c31e54ff8d833551fc59819993ef519d1bb358d77dc3afd8f2a3ce22292be6c867c80a8977d771332b
SSDEEP

12288:H7uk7C8LDMu42r0Dyo6Te5rf1C7nh5YaGND23ax56pw1MJf:HC52r0WorR4Dw23i+w1

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3808-133-0x00000000042D0000-0x0000000004302000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	ysycivhY.pif

Executes dropped EXE 1 IoCs

pid	Process
1732	ysycivhY.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yhvicysy = "C:\\Users\\Public\\Libraries\\ysycivhY.url"	0063526252653123.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 3136	1732	ysycivhY.pif	26
PID 1932 set thread context of 3136	1932	msdt.exe	26

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3620	1372	WerFault.exe	91

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	msdt.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	28	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	32	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1732	ysycivhY.pif
1732	ysycivhY.pif
1732	ysycivhY.pif
1732	ysycivhY.pif
1732	ysycivhY.pif
1732	ysycivhY.pif
1732	ysycivhY.pif
1732	ysycivhY.pif
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3136	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1732	ysycivhY.pif
1732	ysycivhY.pif
1732	ysycivhY.pif
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe
1932	msdt.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	ysycivhY.pif
Token: SeDebugPrivilege	1932	msdt.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 1732	3808	0063526252653123.exe	86
PID 3808 wrote to memory of 1732	3808	0063526252653123.exe	86
PID 3808 wrote to memory of 1732	3808	0063526252653123.exe	86
PID 3808 wrote to memory of 1732	3808	0063526252653123.exe	86
PID 3808 wrote to memory of 1732	3808	0063526252653123.exe	86
PID 3808 wrote to memory of 1732	3808	0063526252653123.exe	86
PID 3136 wrote to memory of 1932	3136	Explorer.EXE	87
PID 3136 wrote to memory of 1932	3136	Explorer.EXE	87
PID 3136 wrote to memory of 1932	3136	Explorer.EXE	87
PID 1932 wrote to memory of 1372	1932	msdt.exe	91
PID 1932 wrote to memory of 1372	1932	msdt.exe	91
PID 1932 wrote to memory of 1372	1932	msdt.exe	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\0063526252653123.exe
  "C:\Users\Admin\AppData\Local\Temp\0063526252653123.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Users\Public\Libraries\ysycivhY.pif
    "C:\Users\Public\Libraries\ysycivhY.pif"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1372
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1372 -s 144
      4⤵
      Program crash
      PID:3620

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 1372 -ip 1372
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\ysycivhY.pif

Filesize
66KB

MD5
c116d3604ceafe7057d77ff27552c215

SHA1
452b14432fb5758b46f2897aeccd89f7c82a727d

SHA256
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

SHA512
9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

Download Submit
C:\Users\Public\Libraries\ysycivhY.pif

Filesize
66KB

MD5
c116d3604ceafe7057d77ff27552c215

SHA1
452b14432fb5758b46f2897aeccd89f7c82a727d

SHA256
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

SHA512
9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

Download Submit
memory/1732-147-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/1732-148-0x00000000026A0000-0x00000000029EA000-memory.dmp

Filesize
3.3MB

Download
memory/1732-154-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1732-150-0x0000000000B30000-0x0000000000B40000-memory.dmp

Filesize
64KB

Download
memory/1732-143-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1732-149-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/1932-155-0x00000000009B0000-0x0000000000A07000-memory.dmp

Filesize
348KB

Download
memory/1932-153-0x00000000009B0000-0x0000000000A07000-memory.dmp

Filesize
348KB

Download
memory/1932-158-0x00000000021A0000-0x000000000222F000-memory.dmp

Filesize
572KB

Download
memory/1932-157-0x0000000002500000-0x000000000284A000-memory.dmp

Filesize
3.3MB

Download
memory/1932-156-0x0000000000140000-0x000000000016D000-memory.dmp

Filesize
180KB

Download
memory/3136-151-0x0000000003380000-0x00000000034A2000-memory.dmp

Filesize
1.1MB

Download
memory/3136-160-0x00000000076C0000-0x000000000776C000-memory.dmp

Filesize
688KB

Download
memory/3136-159-0x00000000076C0000-0x000000000776C000-memory.dmp

Filesize
688KB

Download
memory/3136-162-0x00000000076C0000-0x000000000776C000-memory.dmp

Filesize
688KB

Download
memory/3808-142-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/3808-141-0x0000000010410000-0x000000001043F000-memory.dmp

Filesize
188KB

Download
memory/3808-135-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/3808-136-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/3808-133-0x00000000042D0000-0x0000000004302000-memory.dmp

Filesize
200KB

Download