modiloader | 7dca9d872ff0b85e7914cd56ad409f3ba86f6171225a3627b736768872fb0eff

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2023 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Orderq.exe
Size

2.8MB
MD5

06d908f5a0ad081c36c1f29c5bb8531b
SHA1

c4d069ea2ce5871a2e55a680b660de4ff88d8437
SHA256

7dca9d872ff0b85e7914cd56ad409f3ba86f6171225a3627b736768872fb0eff
SHA512

dbd417e7d2132895af032a42704462fc8919616912774a3d8159a59e9e1b71400afb52e1230746f3da7a80e1a639168ec0d29f57b808f1ba06bfb2adbd6cbb5d
SSDEEP

49152:Xm/PpH8yc0/wU2lpe63ZrxKrVEbRIqiPt41yFehg1mQzZ:XOpcyV/wjpdZrxEVEtI14AqnY

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1104-2-0x00000000044C0000-0x00000000054C0000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Orderq.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bnhnkznp = "C:\\Users\\Public\\Bnhnkznp.url"	Orderq.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

224 1104 WerFault.exe Orderq.exe

pid	pid_target	process	target process
224	1104	WerFault.exe	Orderq.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	32	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	34	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Orderq.exe

pid process

1104 Orderq.exe
1104 Orderq.exe

pid	process
1104	Orderq.exe
1104	Orderq.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Orderq.exe

description	pid	process	target process
PID 1104 wrote to memory of 1840	1104	Orderq.exe	colorcpl.exe
PID 1104 wrote to memory of 1840	1104	Orderq.exe	colorcpl.exe
PID 1104 wrote to memory of 1840	1104	Orderq.exe	colorcpl.exe

C:\Users\Admin\AppData\Local\Temp\Orderq.exe
"C:\Users\Admin\AppData\Local\Temp\Orderq.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\colorcpl.exe
C:\Windows\System32\colorcpl.exe
2⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1796
2⤵
- Program crash
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1104 -ip 1104
1⤵
PID:4888

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-0-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/1104-1-0x00000000044C0000-0x00000000054C0000-memory.dmp

Filesize
16.0MB

Download
memory/1104-2-0x00000000044C0000-0x00000000054C0000-memory.dmp

Filesize
16.0MB

Download
memory/1104-4-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download