modiloader | c0a31c17baaae9d4fe88b19bbaec9fd55733552545692572082bd3c56a79a0fd

General

Target

pdf.exe
Size

1.9MB
MD5

4c681a85055387f6680f9f329f425c45
SHA1

1347e0f77ff1b4fa3d58f15aa863a11bc7ffa9a6
SHA256

c0a31c17baaae9d4fe88b19bbaec9fd55733552545692572082bd3c56a79a0fd
SHA512

32513605638682426e1ac86663872aa5442d0e7f3e7cc196951691e97bc166dd4772d3f5afc3efc2ea6d2a92667eef3250db0a124b284ffa914cd4b6ce79cf18
SSDEEP

49152:Ad8fIwCjykkGo5ITnLK+Ey9S1qXtfRGHKpk3H8eiTwHFimH9jIrMKSIa+GGXHIf8:AdoIwkkrITnG69S1qXtfRGHKpk3H8ei9

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2412-2-0x0000000002F50000-0x0000000003F50000-memory.dmp	modiloader_stage2
behavioral1/memory/2944-74-0x00000000031B0000-0x00000000041B0000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-79-0x0000000003210000-0x0000000004210000-memory.dmp	modiloader_stage2

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2628 2412 WerFault.exe pdf.exe
2384 2944 WerFault.exe pdf.exe
2588 1268 WerFault.exe pdf.exe

pid	pid_target	process	target process
2628	2412	WerFault.exe	pdf.exe
2384	2944	WerFault.exe	pdf.exe
2588	1268	WerFault.exe	pdf.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1600	AUDIODG.EXE
Token: 33	1600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1600	AUDIODG.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

pdf.exepdf.exepdf.exe

description	pid	process	target process
PID 2412 wrote to memory of 2628	2412	pdf.exe	WerFault.exe
PID 2412 wrote to memory of 2628	2412	pdf.exe	WerFault.exe
PID 2412 wrote to memory of 2628	2412	pdf.exe	WerFault.exe
PID 2412 wrote to memory of 2628	2412	pdf.exe	WerFault.exe
PID 2944 wrote to memory of 2384	2944	pdf.exe	WerFault.exe
PID 2944 wrote to memory of 2384	2944	pdf.exe	WerFault.exe
PID 2944 wrote to memory of 2384	2944	pdf.exe	WerFault.exe
PID 2944 wrote to memory of 2384	2944	pdf.exe	WerFault.exe
PID 1268 wrote to memory of 2588	1268	pdf.exe	WerFault.exe
PID 1268 wrote to memory of 2588	1268	pdf.exe	WerFault.exe
PID 1268 wrote to memory of 2588	1268	pdf.exe	WerFault.exe
PID 1268 wrote to memory of 2588	1268	pdf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\pdf.exe
"C:\Users\Admin\AppData\Local\Temp\pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 696
2⤵
- Program crash
PID:2628

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Users\Admin\AppData\Local\Temp\pdf.exe
"C:\Users\Admin\AppData\Local\Temp\pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 692
2⤵
- Program crash
PID:2384

C:\Users\Admin\AppData\Local\Temp\pdf.exe
"C:\Users\Admin\AppData\Local\Temp\pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 688
2⤵
- Program crash
PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7b4557d77c3ac625d2a103e251c72f4

SHA1
ee483420ef3b102c80f92e784f21614190a8f2fb

SHA256
1592d4f30cdf216774b64f8bab510468a1e974913d7497788d104852650147d4

SHA512
aab45b6321acfbfd9a6cca32e9796090baa0bda71b0e44f266479a615e8f598c6fe20a7f0db5beec18862da0e644f92e35532101bd7b8945f5dc41ecba3968d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31303efdebc57366b5d06bdc931c0cae

SHA1
9819e2492e4e206ffcc4809951224349e6cb63ca

SHA256
89aadb4679afc2c6274447e855895258ececc3d940e223332ac8440be57e59b8

SHA512
9df70b65bf2954f07b653f7a9c6b77895e5b3b16f8a947120fb0bc1cb8a04729f603a57ae0e079a0b78602ab04a2e0bd11dcf9728671f5c507417cb476360da6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC375.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1268-76-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1268-138-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download
memory/1268-79-0x0000000003210000-0x0000000004210000-memory.dmp

Filesize
16.0MB

Download
memory/1268-136-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2412-5-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download
memory/2412-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2412-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2412-2-0x0000000002F50000-0x0000000003F50000-memory.dmp

Filesize
16.0MB

Download
memory/2412-1-0x0000000002F50000-0x0000000003F50000-memory.dmp

Filesize
16.0MB

Download
memory/2944-74-0x00000000031B0000-0x00000000041B0000-memory.dmp

Filesize
16.0MB

Download
memory/2944-81-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download
memory/2944-78-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2944-72-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads