modiloader | a87e5df2fd734bb8bf0ee6395289065506e7064b266b90714e9c35b4d2f6c4c7

General

Target

120fc4b8089f3e0b8c37cc6fe99527a4.exe
Size

81KB
MD5

120fc4b8089f3e0b8c37cc6fe99527a4
SHA1

0223c0f378a2121522739c96264e76245d8c34f2
SHA256

a87e5df2fd734bb8bf0ee6395289065506e7064b266b90714e9c35b4d2f6c4c7
SHA512

a3450d5ff51ff1f2ad9e735d9478c6efc21c5ccd1eb68434287fc81465dc9ed4457a79766e0f34384453fc74544dd394be07a4c542df2be8876b09713407f32a
SSDEEP

1536:bWPv13GIJ+cbqWvhzCeJtjxPwFV1FJi1oDb/twZyBiGVvdLuwoSjBH:bWP6ceWvhzJP2woftwQiGhdywoI

Score

10^/10

modiloader njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

russia5319.ddns.net:1177

Mutex

d2c0291b8e251a997c188028968b747b

Attributes

reg_key
d2c0291b8e251a997c188028968b747b
splitter
|'|'|

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2168-20-0x0000000000400000-0x000000000041B000-memory.dmp	modiloader_stage2

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2376	netsh.exe
2516	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
3028	shodanEngine.exe
1232	clener.exe

Loads dropped DLL 2 IoCs

pid	Process
2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe
2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3028	2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe	19
PID 2168 wrote to memory of 3028	2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe	19
PID 2168 wrote to memory of 3028	2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe	19
PID 2168 wrote to memory of 3028	2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe	19
PID 2168 wrote to memory of 1232	2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe	18
PID 2168 wrote to memory of 1232	2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe	18
PID 2168 wrote to memory of 1232	2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe	18
PID 2168 wrote to memory of 1232	2168	120fc4b8089f3e0b8c37cc6fe99527a4.exe	18

C:\Users\Admin\AppData\Local\Temp\120fc4b8089f3e0b8c37cc6fe99527a4.exe
"C:\Users\Admin\AppData\Local\Temp\120fc4b8089f3e0b8c37cc6fe99527a4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\dlhost.exe
  "C:\Users\Admin\AppData\Local\Temp\dlhost.exe"
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dlhost.exe" "dlhost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2376
- C:\Users\Admin\AppData\Local\Temp\clener.exe
  "C:\Users\Admin\AppData\Local\Temp\clener.exe"
  2⤵
  - Executes dropped EXE
  PID:1232
- - C:\Users\Admin\AppData\Roaming\clener.exe
    "C:\Users\Admin\AppData\Roaming\clener.exe"
    3⤵
    PID:1452
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\clener.exe" "clener.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2516
- C:\Users\Admin\AppData\Local\Temp\shodanEngine.exe
  "C:\Users\Admin\AppData\Local\Temp\shodanEngine.exe"
  2⤵
  - Executes dropped EXE
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tar2937.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1232-24-0x0000000072DE0000-0x000000007338B000-memory.dmp

Filesize
5.7MB

Download
memory/1232-27-0x0000000000550000-0x0000000000590000-memory.dmp

Filesize
256KB

Download
memory/1232-28-0x0000000072DE0000-0x000000007338B000-memory.dmp

Filesize
5.7MB

Download
memory/1232-38-0x0000000072DE0000-0x000000007338B000-memory.dmp

Filesize
5.7MB

Download
memory/1452-39-0x0000000072DE0000-0x000000007338B000-memory.dmp

Filesize
5.7MB

Download
memory/1452-41-0x0000000072DE0000-0x000000007338B000-memory.dmp

Filesize
5.7MB

Download
memory/1452-40-0x0000000001F10000-0x0000000001F50000-memory.dmp

Filesize
256KB

Download
memory/1452-447-0x0000000072DE0000-0x000000007338B000-memory.dmp

Filesize
5.7MB

Download
memory/1452-448-0x0000000001F10000-0x0000000001F50000-memory.dmp

Filesize
256KB

Download
memory/2168-20-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2748-290-0x0000000072DE0000-0x000000007338B000-memory.dmp

Filesize
5.7MB

Download
memory/2748-26-0x00000000022D0000-0x0000000002310000-memory.dmp

Filesize
256KB

Download
memory/2748-29-0x0000000072DE0000-0x000000007338B000-memory.dmp

Filesize
5.7MB

Download
memory/2748-23-0x0000000072DE0000-0x000000007338B000-memory.dmp

Filesize
5.7MB

Download
memory/2748-292-0x00000000022D0000-0x0000000002310000-memory.dmp

Filesize
256KB

Download
memory/3028-25-0x0000000073DA0000-0x000000007448E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-291-0x0000000073DA0000-0x000000007448E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-293-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download
memory/3028-22-0x0000000000820000-0x000000000082A000-memory.dmp

Filesize
40KB

Download
memory/3028-30-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads