modiloader | 519a8c7261620400ceff2caa51b22b53bd458e3db948dea06e67a7862883bef3

General

Target

751883053650b7f8396e3ed66337a225.exe
Size

90KB
MD5

751883053650b7f8396e3ed66337a225
SHA1

204330df5796046933669247c56f546bbfa1449e
SHA256

519a8c7261620400ceff2caa51b22b53bd458e3db948dea06e67a7862883bef3
SHA512

aa89c32df49d0bc16769d51a6def84748b75f968d9f8e3267f408c176520b1131a420231079438b39255fbcf796f3a034b7dcc9fbeebfc6cc4d93a65213af144
SSDEEP

1536:hcHA5dZuvrKA1r4Jwwi55dlvo89UBYKpJ0pHWG7m9pAsiyRsUuh8iO70Qdc6mQ:hcg7UrKqUwflAZYKX6aAsiyunQb

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-10-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-12-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-14-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-15-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-16-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-17-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-18-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-19-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-20-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-21-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-22-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-23-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-24-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-25-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-26-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-27-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/284-28-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

msmgrs.exe

pid process

284 msmgrs.exe

pid	process
284	msmgrs.exe

Drops startup file 2 IoCs

Processes:

msmgrs.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk	msmgrs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk	msmgrs.exe

Executes dropped EXE 1 IoCs

Processes:

msmgrs.exe

pid process

284 msmgrs.exe
Loads dropped DLL 2 IoCs

Processes:

751883053650b7f8396e3ed66337a225.exe

pid process

1900 751883053650b7f8396e3ed66337a225.exe
1900 751883053650b7f8396e3ed66337a225.exe

pid	process
284	msmgrs.exe

pid	process
1900	751883053650b7f8396e3ed66337a225.exe
1900	751883053650b7f8396e3ed66337a225.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1900-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx
\Windows\SysWOW64\wins\setup\msmgrs.exe	upx
behavioral1/memory/1900-5-0x0000000002EE0000-0x0000000002F1C000-memory.dmp	upx
behavioral1/memory/1900-10-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-12-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-14-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-15-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-16-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-17-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-18-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-19-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-20-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-21-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-22-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-23-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-24-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-25-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-26-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-27-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/284-28-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

751883053650b7f8396e3ed66337a225.exe

description	ioc	process
File created	C:\Windows\SysWOW64\wins\setup\msmgrs.exe	751883053650b7f8396e3ed66337a225.exe
File opened for modification	C:\Windows\SysWOW64\wins\setup\msmgrs.exe	751883053650b7f8396e3ed66337a225.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

751883053650b7f8396e3ed66337a225.exemsmgrs.exe

pid process

1900 751883053650b7f8396e3ed66337a225.exe
1900 751883053650b7f8396e3ed66337a225.exe
284 msmgrs.exe
284 msmgrs.exe

pid	process
1900	751883053650b7f8396e3ed66337a225.exe
1900	751883053650b7f8396e3ed66337a225.exe
284	msmgrs.exe
284	msmgrs.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

751883053650b7f8396e3ed66337a225.exemsmgrs.execmd.execmd.exe

description	pid	process	target process
PID 1900 wrote to memory of 284	1900	751883053650b7f8396e3ed66337a225.exe	msmgrs.exe
PID 1900 wrote to memory of 284	1900	751883053650b7f8396e3ed66337a225.exe	msmgrs.exe
PID 1900 wrote to memory of 284	1900	751883053650b7f8396e3ed66337a225.exe	msmgrs.exe
PID 1900 wrote to memory of 284	1900	751883053650b7f8396e3ed66337a225.exe	msmgrs.exe
PID 284 wrote to memory of 2812	284	msmgrs.exe	cmd.exe
PID 284 wrote to memory of 2812	284	msmgrs.exe	cmd.exe
PID 284 wrote to memory of 2812	284	msmgrs.exe	cmd.exe
PID 284 wrote to memory of 2812	284	msmgrs.exe	cmd.exe
PID 284 wrote to memory of 2784	284	msmgrs.exe	cmd.exe
PID 284 wrote to memory of 2784	284	msmgrs.exe	cmd.exe
PID 284 wrote to memory of 2784	284	msmgrs.exe	cmd.exe
PID 284 wrote to memory of 2784	284	msmgrs.exe	cmd.exe
PID 2784 wrote to memory of 2708	2784	cmd.exe	regsvr32.exe
PID 2784 wrote to memory of 2708	2784	cmd.exe	regsvr32.exe
PID 2784 wrote to memory of 2708	2784	cmd.exe	regsvr32.exe
PID 2784 wrote to memory of 2708	2784	cmd.exe	regsvr32.exe
PID 2784 wrote to memory of 2708	2784	cmd.exe	regsvr32.exe
PID 2784 wrote to memory of 2708	2784	cmd.exe	regsvr32.exe
PID 2784 wrote to memory of 2708	2784	cmd.exe	regsvr32.exe
PID 2812 wrote to memory of 2868	2812	cmd.exe	regsvr32.exe
PID 2812 wrote to memory of 2868	2812	cmd.exe	regsvr32.exe
PID 2812 wrote to memory of 2868	2812	cmd.exe	regsvr32.exe
PID 2812 wrote to memory of 2868	2812	cmd.exe	regsvr32.exe
PID 2812 wrote to memory of 2868	2812	cmd.exe	regsvr32.exe
PID 2812 wrote to memory of 2868	2812	cmd.exe	regsvr32.exe
PID 2812 wrote to memory of 2868	2812	cmd.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\751883053650b7f8396e3ed66337a225.exe
"C:\Users\Admin\AppData\Local\Temp\751883053650b7f8396e3ed66337a225.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\wins\setup\msmgrs.exe
"C:\Windows\system32\wins\setup\msmgrs.exe"
2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:284

C:\Windows\SysWOW64\cmd.exe
cmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEditControl.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEditControl.dll
4⤵
PID:2868

C:\Windows\SysWOW64\cmd.exe
cmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/tebedit.ocx
3⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /u /s C:\Windows/"Downloaded Program Files"/tebedit.ocx
4⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\wins\setup\msmgrs.exe
Filesize
90KB

MD5
751883053650b7f8396e3ed66337a225

SHA1
204330df5796046933669247c56f546bbfa1449e

SHA256
519a8c7261620400ceff2caa51b22b53bd458e3db948dea06e67a7862883bef3

SHA512
aa89c32df49d0bc16769d51a6def84748b75f968d9f8e3267f408c176520b1131a420231079438b39255fbcf796f3a034b7dcc9fbeebfc6cc4d93a65213af144

Download Submit
memory/284-19-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-28-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-14-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-16-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-27-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-26-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/284-25-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1900-5-0x0000000002EE0000-0x0000000002F1C000-memory.dmp

Filesize
240KB

Download
memory/1900-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1900-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads