modiloader | e0f492b56cdde36c64daa34406e43e16113e7b7e43952895529dea6b65eacd6b

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

BuhtaClient.exe
Size

12.9MB
MD5

c82005128e4de1cad09fbde5fdef3290
SHA1

f4cfb7e40efb4a2a74ef734cb7dc0b70d2348ab4
SHA256

612a2dcda3fcec5e2b4e0ca7c6f99952ef9274a482445c439261597884db5848
SHA512

622d8f81193d57c30ffa12b8f3d4ada6d52d6fe229d2b0a9b6fe79f52dd531ecc25334d2016204e943efe1060267aa323d446b88d783fd4e20b68fbc88af2d13
SSDEEP

196608:tenHQWQw5KP+4OQF51fa51F5zttrD2VmfXooAl2qSzTfv6YbKaqKpIPuS/HCQ:t+D5Kmk1CPz7rqvl2qS3X7ld

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 3 IoCs

resource	yara_rule
behavioral4/memory/4652-1-0x0000000000400000-0x0000000002D0B000-memory.dmp	modiloader_stage1
behavioral4/memory/4652-2-0x0000000000400000-0x0000000002D0B000-memory.dmp	modiloader_stage1
behavioral4/memory/4652-6-0x0000000000400000-0x0000000002D0B000-memory.dmp	modiloader_stage1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5040	4652	WerFault.exe	87

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BuhtaClient.exe /bmProjectPivotExcelModule"	BuhtaClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bmProject.EventSupportBMPro\ = "Ïðîãðàììà ÁÓÕòà 1.0"	BuhtaClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bmProject.EventSupportBMPro\Clsid	BuhtaClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}\Version	BuhtaClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}	BuhtaClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}\ = "Ïðîãðàììà ÁÓÕòà 1.0"	BuhtaClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}\Version\ = "1.0"	BuhtaClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bmProject.EventSupportBMPro	BuhtaClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bmProject.EventSupportBMPro\Clsid\ = "{88861623-2B95-4BE1-B165-AACA7B43A353}"	BuhtaClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}\ProgID\ = "bmProject.EventSupportBMPro"	BuhtaClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}\TypeLib	BuhtaClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}\TypeLib\ = "{655F813B-DED0-4053-AB5C-2250F76AB966}"	BuhtaClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}\LocalServer32	BuhtaClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88861623-2B95-4BE1-B165-AACA7B43A353}\ProgID	BuhtaClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4652	BuhtaClient.exe
4652	BuhtaClient.exe
4652	BuhtaClient.exe
4652	BuhtaClient.exe
4652	BuhtaClient.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2108	4652	BuhtaClient.exe	91
PID 4652 wrote to memory of 2108	4652	BuhtaClient.exe	91

C:\Users\Admin\AppData\Local\Temp\BuhtaClient.exe
"C:\Users\Admin\AppData\Local\Temp\BuhtaClient.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1360
  2⤵
  - Program crash
  PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4652 -ip 4652
1⤵
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4652-0-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/4652-1-0x0000000000400000-0x0000000002D0B000-memory.dmp

Filesize
41.0MB

Download
memory/4652-2-0x0000000000400000-0x0000000002D0B000-memory.dmp

Filesize
41.0MB

Download
memory/4652-3-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/4652-6-0x0000000000400000-0x0000000002D0B000-memory.dmp

Filesize
41.0MB

Download