modiloader | 54be9ba2765771cc0ba840828116938a88a6bc48732f79113afd36b3e1c264ba

Analysis

max time kernel
140s
max time network
140s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06-06-2023 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02208999.exe
Size

842KB
MD5

03f68e754aaa9699ee2ef3396020e5ae
SHA1

1006050371550d0a31c17664e51a1ad91473ff6f
SHA256

54be9ba2765771cc0ba840828116938a88a6bc48732f79113afd36b3e1c264ba
SHA512

dcd0913e92b574e0ea795aa3508a6a10516366230ed06233f3c237f8fb227f827f88c1b23eaf7aff05277b7c5b5579f6d7fdaa4763c02c71a854da63ee458bce
SSDEEP

12288:tqcXKzYRKvoT9GfENy1H+n4J6m39o8K796Wbk0SDpcCMZMg:tfXKoT9GfENy1H9Q7f796Wbk0OpcI

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2000-54-0x0000000001EA0000-0x0000000001ED2000-memory.dmp	modiloader_stage2

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

02208999.exe

description	ioc	process
File opened (read-only)	\??\M:	02208999.exe
File opened (read-only)	\??\R:	02208999.exe
File opened (read-only)	\??\V:	02208999.exe
File opened (read-only)	\??\Z:	02208999.exe
File opened (read-only)	\??\B:	02208999.exe
File opened (read-only)	\??\E:	02208999.exe
File opened (read-only)	\??\U:	02208999.exe
File opened (read-only)	\??\X:	02208999.exe
File opened (read-only)	\??\Y:	02208999.exe
File opened (read-only)	\??\F:	02208999.exe
File opened (read-only)	\??\J:	02208999.exe
File opened (read-only)	\??\P:	02208999.exe
File opened (read-only)	\??\Q:	02208999.exe
File opened (read-only)	\??\I:	02208999.exe
File opened (read-only)	\??\K:	02208999.exe
File opened (read-only)	\??\H:	02208999.exe
File opened (read-only)	\??\L:	02208999.exe
File opened (read-only)	\??\N:	02208999.exe
File opened (read-only)	\??\O:	02208999.exe
File opened (read-only)	\??\S:	02208999.exe
File opened (read-only)	\??\T:	02208999.exe
File opened (read-only)	\??\A:	02208999.exe
File opened (read-only)	\??\G:	02208999.exe
File opened (read-only)	\??\W:	02208999.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

644 2000 WerFault.exe 02208999.exe

pid	pid_target	process	target process
644	2000	WerFault.exe	02208999.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

02208999.exe

description	pid	process	target process
PID 2000 wrote to memory of 644	2000	02208999.exe	WerFault.exe
PID 2000 wrote to memory of 644	2000	02208999.exe	WerFault.exe
PID 2000 wrote to memory of 644	2000	02208999.exe	WerFault.exe
PID 2000 wrote to memory of 644	2000	02208999.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\02208999.exe
"C:\Users\Admin\AppData\Local\Temp\02208999.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 704
2⤵
- Program crash
PID:644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar964F.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/2000-54-0x0000000001EA0000-0x0000000001ED2000-memory.dmp

Filesize
200KB

Download
memory/2000-56-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2000-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download