modiloader | 792872cea402db146c57f3c33e179adb5dd677b4425059a7ab1fb22a02bc7ed3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a5721df5cc2c9ab20dda8f7ead3c272.exe
Size 270KB
Sample240108-d7xcvsbeb5
SHA256 792872cea402db146c57f3c33e179adb5dd677b4425059a7ab1fb22a02bc7ed3
MD5 4a5721df5cc2c9ab20dda8f7ead3c272
SHA1 7d203bc2570ca56fbf582207352b423759783959
SHA512 820207e8245f25923735b4edea79a5838c9ba74ed2d6d2216bdacfce0edb99bcccdbef6a18831ff4078469af81488912677593ebc1ba4e6281f4ef24a1bba113
SSDEEP 6144:B10d/oYkkiOrbU5qsVvAi9eTiYmTrQxgK94t8vkah4YtLE7LkPDfHZ:Md/rkkiOr45qsB3eOH/3aRI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/2880-15-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2
behavioral1/memory/1972-27-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-29-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2
behavioral1/memory/1972-37-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2636	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2880	setv.exe

Loads dropped DLL 5 IoCs

pid	Process
1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe
1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe
2724	WerFault.exe
2724	WerFault.exe
2724	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_setv.exe	setv.exe
File opened for modification	C:\Windows\SysWOW64\_setv.exe	setv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2880 set thread context of 2756	2880	setv.exe	29

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe	4a5721df5cc2c9ab20dda8f7ead3c272.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe	4a5721df5cc2c9ab20dda8f7ead3c272.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	4a5721df5cc2c9ab20dda8f7ead3c272.exe

Program crash 1 IoCs

pid	pid_target	Process
2724	2880	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2880	1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe	30
PID 1972 wrote to memory of 2880	1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe	30
PID 1972 wrote to memory of 2880	1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe	30
PID 1972 wrote to memory of 2880	1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe	30
PID 2880 wrote to memory of 2756	2880	setv.exe	29
PID 2880 wrote to memory of 2756	2880	setv.exe	29
PID 2880 wrote to memory of 2756	2880	setv.exe	29
PID 2880 wrote to memory of 2756	2880	setv.exe	29
PID 2880 wrote to memory of 2756	2880	setv.exe	29
PID 2880 wrote to memory of 2756	2880	setv.exe	29
PID 2880 wrote to memory of 2724	2880	setv.exe	28
PID 2880 wrote to memory of 2724	2880	setv.exe	28
PID 2880 wrote to memory of 2724	2880	setv.exe	28
PID 2880 wrote to memory of 2724	2880	setv.exe	28
PID 1972 wrote to memory of 2636	1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe	32
PID 1972 wrote to memory of 2636	1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe	32
PID 1972 wrote to memory of 2636	1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe	32
PID 1972 wrote to memory of 2636	1972	4a5721df5cc2c9ab20dda8f7ead3c272.exe	32

C:\Users\Admin\AppData\Local\Temp\4a5721df5cc2c9ab20dda8f7ead3c272.exe
"C:\Users\Admin\AppData\Local\Temp\4a5721df5cc2c9ab20dda8f7ead3c272.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
  2⤵
  - Deletes itself
  PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 280
1⤵
- Loads dropped DLL
- Program crash
PID:2724

C:\Windows\SysWOW64\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-0-0x0000000000400000-0x000000000050D000-memory.dmp

Download

memory/1972-1-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/1972-11-0x0000000003060000-0x000000000316D000-memory.dmp

Download

memory/1972-27-0x0000000000400000-0x000000000050D000-memory.dmp

Download

memory/1972-28-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/1972-37-0x0000000000400000-0x000000000050D000-memory.dmp

Download

memory/2756-21-0x0000000000400000-0x000000000050D000-memory.dmp

Download

memory/2756-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2880-16-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/2880-15-0x0000000000400000-0x000000000050D000-memory.dmp

Download

memory/2880-29-0x0000000000400000-0x000000000050D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads