modiloader | 22c0b06fc10fcc0244ca749e3ed55fcb3f6858178a5800a8cb98fd5ff28a0f02

Analysis

max time kernel
7s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe7e6ab79f347ca092fcfd4c0c349dca.exe
Size

651KB
MD5

fe7e6ab79f347ca092fcfd4c0c349dca
SHA1

e14d383c51074bd6073ae30f08306ebf10eaf27a
SHA256

22c0b06fc10fcc0244ca749e3ed55fcb3f6858178a5800a8cb98fd5ff28a0f02
SHA512

2cf78f968330ab6bbfc1dc7d4afb2dfde2dbfc48273bb95c8f5cc00c167e149bec5119073311dbc9b1c3ca94ee19df624c160229f27c3a21ba0fa4303e0c5341
SSDEEP

12288:kpyZT1lrCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1ljOD3SxcDDcNDqWYurL0

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 20 IoCs

resource	yara_rule
behavioral2/memory/2488-3-0x0000000000400000-0x000000000041C000-memory.dmp	modiloader_stage2
behavioral2/memory/4428-7-0x0000000000400000-0x0000000000507000-memory.dmp	modiloader_stage2
behavioral2/memory/4428-6-0x0000000000400000-0x0000000000507000-memory.dmp	modiloader_stage2
behavioral2/memory/988-60-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/4428-65-0x0000000000400000-0x0000000000507000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-68-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-71-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-75-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/5096-85-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-111-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-114-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-117-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/4428-118-0x0000000000400000-0x0000000000507000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-121-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-123-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-125-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-127-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-129-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-131-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-133-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1344	dHY4IvP3.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4428-0-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4428-7-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4428-6-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4428-5-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4428-1-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4428-65-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/372-89-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/372-88-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/372-87-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/372-80-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/372-79-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4428-118-0x0000000000400000-0x0000000000507000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2488 set thread context of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
3220	372	WerFault.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3652	tasklist.exe
3156	tasklist.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1344	dHY4IvP3.exe
1344	dHY4IvP3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4428	fe7e6ab79f347ca092fcfd4c0c349dca.exe
1344	dHY4IvP3.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73
PID 2488 wrote to memory of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73
PID 2488 wrote to memory of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73
PID 2488 wrote to memory of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73
PID 2488 wrote to memory of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73
PID 2488 wrote to memory of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73
PID 2488 wrote to memory of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73
PID 2488 wrote to memory of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73
PID 2488 wrote to memory of 4428	2488	fe7e6ab79f347ca092fcfd4c0c349dca.exe	73
PID 4428 wrote to memory of 1344	4428	fe7e6ab79f347ca092fcfd4c0c349dca.exe	92
PID 4428 wrote to memory of 1344	4428	fe7e6ab79f347ca092fcfd4c0c349dca.exe	92
PID 4428 wrote to memory of 1344	4428	fe7e6ab79f347ca092fcfd4c0c349dca.exe	92

C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe
"C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe
  fe7e6ab79f347ca092fcfd4c0c349dca.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Users\Admin\dHY4IvP3.exe
    C:\Users\Admin\dHY4IvP3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1344
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del dHY4IvP3.exe
      4⤵
      PID:2816
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:3652
  - - C:\Users\Admin\taiozo.exe
      "C:\Users\Admin\taiozo.exe"
      4⤵
      PID:4928
- - C:\Users\Admin\azhost.exe
    C:\Users\Admin\azhost.exe
    3⤵
    PID:988
  - - C:\Users\Admin\azhost.exe
      azhost.exe
      4⤵
      PID:4000
- - C:\Users\Admin\bzhost.exe
    C:\Users\Admin\bzhost.exe
    3⤵
    PID:3596
- - C:\Users\Admin\czhost.exe
    C:\Users\Admin\czhost.exe
    3⤵
    PID:5096
  - - C:\Users\Admin\czhost.exe
      czhost.exe
      4⤵
      PID:372
- - C:\Users\Admin\dzhost.exe
    C:\Users\Admin\dzhost.exe
    3⤵
    PID:4584
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:4540
- - C:\Users\Admin\ezhost.exe
    C:\Users\Admin\ezhost.exe
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del fe7e6ab79f347ca092fcfd4c0c349dca.exe
    3⤵
    PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 372 -ip 372
1⤵
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 228
1⤵
- Program crash
PID:3220

C:\Windows\SysWOW64\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/372-88-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/372-89-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/372-80-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/372-79-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/372-87-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/988-60-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2488-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3596-117-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-123-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-121-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-125-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-114-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-111-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-127-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-68-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-71-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-75-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-129-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-131-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-133-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4000-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4000-53-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4000-66-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4000-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4000-61-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4000-55-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4428-65-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4428-0-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4428-7-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4428-6-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4428-5-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4428-1-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4428-118-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4584-103-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4584-100-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4584-95-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4584-96-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4584-94-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4584-99-0x00000000006D4000-0x00000000006D5000-memory.dmp

Filesize
4KB

Download
memory/4584-97-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4584-98-0x00000000006D0000-0x0000000000734000-memory.dmp

Filesize
400KB

Download
memory/5096-85-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download