modiloader | c61b6132bd5550bffa104fb1614295fb6829aa90f239e524a4e1c6456594151a

General

Target

24352769438d61875a85be34df54e076.exe
Size

1.0MB
MD5

24352769438d61875a85be34df54e076
SHA1

4bc9fa6b937814e7c38c87b494ac8259d9612c82
SHA256

c61b6132bd5550bffa104fb1614295fb6829aa90f239e524a4e1c6456594151a
SHA512

4750c93301fc32dfb2cb5a992499645daef9874f71fbb986292db3e19a917228cad146823695ee4afbccea2db04e0cf5610a21649852a197eac9b24911ca5036
SSDEEP

24576:v4lg1mQp6POQJxPy3t3X6pX8c6VTZVa9QmXGzU:v4G11UPVJxPydnsXKdVaqm2zU

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/1052-14-0x0000000010000000-0x0000000010114000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-43-0x0000000010000000-0x0000000010114000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-41-0x0000000010000000-0x0000000010114000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2692	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2704	svchost.com
2788	svchost.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	24352769438d61875a85be34df54e076.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 2204	1052	24352769438d61875a85be34df54e076.exe	28
PID 2704 set thread context of 2788	2704	svchost.com	33

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.com	24352769438d61875a85be34df54e076.exe
File opened for modification	C:\Windows\svchost.com	24352769438d61875a85be34df54e076.exe

Program crash 1 IoCs

pid	pid_target	Process
2596	2788	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	2204	24352769438d61875a85be34df54e076.exe
Token: SeSystemtimePrivilege	2204	24352769438d61875a85be34df54e076.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2204	1052	24352769438d61875a85be34df54e076.exe	28
PID 1052 wrote to memory of 2204	1052	24352769438d61875a85be34df54e076.exe	28
PID 1052 wrote to memory of 2204	1052	24352769438d61875a85be34df54e076.exe	28
PID 1052 wrote to memory of 2204	1052	24352769438d61875a85be34df54e076.exe	28
PID 1052 wrote to memory of 2204	1052	24352769438d61875a85be34df54e076.exe	28
PID 1052 wrote to memory of 2204	1052	24352769438d61875a85be34df54e076.exe	28
PID 2204 wrote to memory of 2704	2204	24352769438d61875a85be34df54e076.exe	29
PID 2204 wrote to memory of 2704	2204	24352769438d61875a85be34df54e076.exe	29
PID 2204 wrote to memory of 2704	2204	24352769438d61875a85be34df54e076.exe	29
PID 2204 wrote to memory of 2704	2204	24352769438d61875a85be34df54e076.exe	29
PID 2704 wrote to memory of 2788	2704	svchost.com	33
PID 2704 wrote to memory of 2788	2704	svchost.com	33
PID 2704 wrote to memory of 2788	2704	svchost.com	33
PID 2704 wrote to memory of 2788	2704	svchost.com	33
PID 2704 wrote to memory of 2788	2704	svchost.com	33
PID 2704 wrote to memory of 2788	2704	svchost.com	33
PID 2204 wrote to memory of 2692	2204	24352769438d61875a85be34df54e076.exe	31
PID 2204 wrote to memory of 2692	2204	24352769438d61875a85be34df54e076.exe	31
PID 2204 wrote to memory of 2692	2204	24352769438d61875a85be34df54e076.exe	31
PID 2204 wrote to memory of 2692	2204	24352769438d61875a85be34df54e076.exe	31
PID 2788 wrote to memory of 2596	2788	svchost.com	32
PID 2788 wrote to memory of 2596	2788	svchost.com	32
PID 2788 wrote to memory of 2596	2788	svchost.com	32
PID 2788 wrote to memory of 2596	2788	svchost.com	32

C:\Users\Admin\AppData\Local\Temp\24352769438d61875a85be34df54e076.exe
"C:\Users\Admin\AppData\Local\Temp\24352769438d61875a85be34df54e076.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\24352769438d61875a85be34df54e076.exe
  C:\Users\Admin\AppData\Local\Temp\24352769438d61875a85be34df54e076.exe
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\svchost.com
    C:\Windows\svchost.com
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\svchost.com
      C:\Windows\svchost.com
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\system32\Deleteme.bat
    3⤵
    - Deletes itself
    PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 220
1⤵
- Program crash
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat

Filesize
184B

MD5
d1abaa6a03c20165e62631f8d0155794

SHA1
26403f2768167c12e5b00f79ec1e3143810226f4

SHA256
8e7a7ec6e15b98f48bacb9e3e23a14446a1581040bdd5edea8fc5c2aaf080739

SHA512
c940300b4c641eda17e5300fd134d31352c0e34ab225df9de51c15a74158283963234fe5750e678224afb82bf01188a0b0203cb96c54fb3b9293a3b132ba43bc

Download Submit
C:\Windows\svchost.com

Filesize
1.0MB

MD5
24352769438d61875a85be34df54e076

SHA1
4bc9fa6b937814e7c38c87b494ac8259d9612c82

SHA256
c61b6132bd5550bffa104fb1614295fb6829aa90f239e524a4e1c6456594151a

SHA512
4750c93301fc32dfb2cb5a992499645daef9874f71fbb986292db3e19a917228cad146823695ee4afbccea2db04e0cf5610a21649852a197eac9b24911ca5036

Download Submit
C:\Windows\svchost.com

Filesize
766KB

MD5
7a07c3d533909be042b4835610dfd42c

SHA1
111a30fd8a1c96e18ad073a177ae9f3d7e56519f

SHA256
fd92cb1aa56a6c9bf6e2111d58415304c9045f8f06df3c860fb9dec04f693b8e

SHA512
7a510c5d3c1c2be2dc4d7ddd7347ab61d3a3a3118e9e76ccb0c882e0382159714bf186a026328fcf8d3001d06b75e5af8ab49564446dbe8d3f1a9f4ad69f79db

Download Submit
C:\Windows\svchost.com

Filesize
408KB

MD5
4f117869b48535c6a78a1876d9799687

SHA1
409914417df9ba18da129eee3b52bc017a948ee6

SHA256
b9349630279e1dad12771329fc7e36db4533e1fab8507ac03a580d2e8593dd4e

SHA512
3e4d47ad47b1b23cbd47046b79abf2d1328910508fe22863477ec6c752ac524d09a40005ef9080bb6292204a8e0a09f074725d28769bbcf8bdfe6a9a37d85769

Download Submit
C:\Windows\svchost.com

Filesize
96KB

MD5
ddc472abb46e5b1c4f657f45b5575571

SHA1
0280222fdc5c37a53129179c09af22ab3d8e8c37

SHA256
3acbd9ef20998a10ef3618de6f3d95f1f4c5631d650d5ceb9470d7de09ba1a34

SHA512
8d778e3dd0b47114845910c68376c8e0f0ef3123cf2f95e98c56b2c3b87eb23a90522ce9ba0bc230bd36c31c0811f3d9d42657f56ec08d4662569b7923156dd0

Download Submit
memory/1052-17-0x0000000000300000-0x0000000000354000-memory.dmp

Filesize
336KB

Download
memory/1052-6-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/1052-3-0x0000000001C30000-0x0000000001C31000-memory.dmp

Filesize
4KB

Download
memory/1052-2-0x0000000001C50000-0x0000000001C51000-memory.dmp

Filesize
4KB

Download
memory/1052-1-0x0000000000300000-0x0000000000354000-memory.dmp

Filesize
336KB

Download
memory/1052-0-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/1052-16-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/1052-7-0x0000000001C10000-0x0000000001C11000-memory.dmp

Filesize
4KB

Download
memory/1052-18-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/1052-14-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/1052-13-0x0000000001C60000-0x0000000001C61000-memory.dmp

Filesize
4KB

Download
memory/1052-11-0x0000000001C70000-0x0000000001C71000-memory.dmp

Filesize
4KB

Download
memory/1052-9-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/2204-24-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2204-53-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2204-20-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2204-19-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/2204-29-0x00000000031F0000-0x0000000003304000-memory.dmp

Filesize
1.1MB

Download
memory/2204-15-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2204-4-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2204-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2204-12-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2204-23-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2704-43-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/2704-36-0x0000000003030000-0x0000000003031000-memory.dmp

Filesize
4KB

Download
memory/2704-34-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/2704-41-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/2704-39-0x0000000003540000-0x0000000003654000-memory.dmp

Filesize
1.1MB

Download
memory/2704-33-0x0000000001BB0000-0x0000000001C04000-memory.dmp

Filesize
336KB

Download
memory/2788-55-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2788-54-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download

Analysis

Sharing