modiloader | 768fb3bf2fb98b914d90df05e91db2ba14378b4e64c85e82ec09a8f45b58d3dc

General

Target

00ca404579121f88d4ac1b8934146005.exe
Size

17KB
MD5

00ca404579121f88d4ac1b8934146005
SHA1

051d3155ffd3075a729ba88aa2b65e42358f2d8e
SHA256

768fb3bf2fb98b914d90df05e91db2ba14378b4e64c85e82ec09a8f45b58d3dc
SHA512

89b7f659df52d8d34cac2fb04923dc6eeea3b7ffc2387ead74e0b9234050ac4b286980280dbc82de765409cc1be4c943d1bf5a31d8858694fe21fbb70b036103
SSDEEP

384:6phOmDzSIR/VJZ3apj6q7a846Yr1nbmVGMB7r2:6ph7rtvGh+88byGM9i

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2264-4-0x0000000013140000-0x000000001314B000-memory.dmp	modiloader_stage2

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2072-7-0x0000000000400000-0x0000000000406000-memory.dmp	upx
behavioral1/memory/2072-11-0x0000000000400000-0x0000000000406000-memory.dmp	upx
behavioral1/memory/2072-9-0x0000000000400000-0x0000000000406000-memory.dmp	upx
behavioral1/memory/2072-6-0x0000000000400000-0x0000000000406000-memory.dmp	upx
behavioral1/memory/2072-3-0x0000000000400000-0x0000000000406000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2264 set thread context of 2072	2264	00ca404579121f88d4ac1b8934146005.exe	18

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2688	NOTEPAD.EXE
2736	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2264	00ca404579121f88d4ac1b8934146005.exe
2264	00ca404579121f88d4ac1b8934146005.exe
2264	00ca404579121f88d4ac1b8934146005.exe
2264	00ca404579121f88d4ac1b8934146005.exe
2264	00ca404579121f88d4ac1b8934146005.exe
2264	00ca404579121f88d4ac1b8934146005.exe
2264	00ca404579121f88d4ac1b8934146005.exe
2264	00ca404579121f88d4ac1b8934146005.exe
2264	00ca404579121f88d4ac1b8934146005.exe
2264	00ca404579121f88d4ac1b8934146005.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	00ca404579121f88d4ac1b8934146005.exe
Token: SeDebugPrivilege	2264	00ca404579121f88d4ac1b8934146005.exe
Token: SeDebugPrivilege	2264	00ca404579121f88d4ac1b8934146005.exe
Token: SeDebugPrivilege	2264	00ca404579121f88d4ac1b8934146005.exe
Token: SeDebugPrivilege	2264	00ca404579121f88d4ac1b8934146005.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2072	2264	00ca404579121f88d4ac1b8934146005.exe	18
PID 2264 wrote to memory of 2072	2264	00ca404579121f88d4ac1b8934146005.exe	18
PID 2264 wrote to memory of 2072	2264	00ca404579121f88d4ac1b8934146005.exe	18
PID 2264 wrote to memory of 2072	2264	00ca404579121f88d4ac1b8934146005.exe	18
PID 2264 wrote to memory of 2072	2264	00ca404579121f88d4ac1b8934146005.exe	18
PID 2264 wrote to memory of 2072	2264	00ca404579121f88d4ac1b8934146005.exe	18
PID 2072 wrote to memory of 2688	2072	00ca404579121f88d4ac1b8934146005.exe	16
PID 2072 wrote to memory of 2688	2072	00ca404579121f88d4ac1b8934146005.exe	16
PID 2072 wrote to memory of 2688	2072	00ca404579121f88d4ac1b8934146005.exe	16
PID 2072 wrote to memory of 2688	2072	00ca404579121f88d4ac1b8934146005.exe	16
PID 2072 wrote to memory of 2736	2072	00ca404579121f88d4ac1b8934146005.exe	17
PID 2072 wrote to memory of 2736	2072	00ca404579121f88d4ac1b8934146005.exe	17
PID 2072 wrote to memory of 2736	2072	00ca404579121f88d4ac1b8934146005.exe	17
PID 2072 wrote to memory of 2736	2072	00ca404579121f88d4ac1b8934146005.exe	17

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\1.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2688

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Readme.ru.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2736

C:\Users\Admin\AppData\Local\Temp\00ca404579121f88d4ac1b8934146005.exe
C:\Users\Admin\AppData\Local\Temp\00ca404579121f88d4ac1b8934146005.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\00ca404579121f88d4ac1b8934146005.exe
"C:\Users\Admin\AppData\Local\Temp\00ca404579121f88d4ac1b8934146005.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2072-11-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2072-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2072-6-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2072-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2072-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2072-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2264-4-0x0000000013140000-0x000000001314B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing