modiloader | e4fcfcbddb08aacf710197c6d5a7bc2713fb126874ea7564aeb3edf727535614

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/01/2024, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84ba6f93d1d9b0cd60bf0c4930845fb5.exe
Size 679KB
Sample240131-sgpyeseff8
SHA256 e4fcfcbddb08aacf710197c6d5a7bc2713fb126874ea7564aeb3edf727535614
MD5 84ba6f93d1d9b0cd60bf0c4930845fb5
SHA1 415684c828ac5e269455d137b2c52cdd9d28686b
SHA512 a3fbf173c8b859594dd2ad9f179287fe485b51fda2a5fdad9a2eb821ed84cd251cb579a9ba1854c7a7a40205b0389069cfcbe1a4a4fb3a0a9276487a0959f876
SSDEEP 12288:w4STGmoX7n2iPh2vRZ5dsYghNgBM1F3Z4mxxjxhJ6/O0fUe:tmob7PaZ4YghNz1QmXjxhJq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 12 IoCs

resource	yara_rule
behavioral1/files/0x000d000000013ac5-21.dat	modiloader_stage2
behavioral1/files/0x000d000000013ac5-19.dat	modiloader_stage2
behavioral1/files/0x000d000000013ac5-23.dat	modiloader_stage2
behavioral1/files/0x000d000000013ac5-17.dat	modiloader_stage2
behavioral1/files/0x000d000000013ac5-15.dat	modiloader_stage2
behavioral1/files/0x00090000000142cc-42.dat	modiloader_stage2
behavioral1/memory/2356-55-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2
behavioral1/memory/2568-54-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2
behavioral1/memory/2740-51-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2
behavioral1/files/0x00090000000142cc-43.dat	modiloader_stage2
behavioral1/files/0x00090000000142cc-38.dat	modiloader_stage2
behavioral1/files/0x00090000000142cc-36.dat	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
2356	4.exe
2568	SVCH0ST.EXE

Loads dropped DLL 4 IoCs

pid	Process
2792	84ba6f93d1d9b0cd60bf0c4930845fb5.exe
2792	84ba6f93d1d9b0cd60bf0c4930845fb5.exe
2356	4.exe
2356	4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	84ba6f93d1d9b0cd60bf0c4930845fb5.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	4.exe
File opened (read-only)	\??\E:	4.exe
File opened (read-only)	\??\M:	4.exe
File opened (read-only)	\??\O:	4.exe
File opened (read-only)	\??\Q:	4.exe
File opened (read-only)	\??\R:	4.exe
File opened (read-only)	\??\W:	4.exe
File opened (read-only)	\??\I:	4.exe
File opened (read-only)	\??\P:	4.exe
File opened (read-only)	\??\T:	4.exe
File opened (read-only)	\??\V:	4.exe
File opened (read-only)	\??\B:	4.exe
File opened (read-only)	\??\G:	4.exe
File opened (read-only)	\??\H:	4.exe
File opened (read-only)	\??\J:	4.exe
File opened (read-only)	\??\L:	4.exe
File opened (read-only)	\??\N:	4.exe
File opened (read-only)	\??\U:	4.exe
File opened (read-only)	\??\Y:	4.exe
File opened (read-only)	\??\Z:	4.exe
File opened (read-only)	\??\K:	4.exe
File opened (read-only)	\??\S:	4.exe
File opened (read-only)	\??\X:	4.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\AutoRun.inf	4.exe
File opened for modification	F:\AutoRun.inf	4.exe
File created	C:\AutoRun.inf	4.exe
File opened for modification	C:\AutoRun.inf	4.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_SVCH0ST.EXE	SVCH0ST.EXE
File opened for modification	C:\Windows\SysWOW64\_SVCH0ST.EXE	SVCH0ST.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 2740	2568	SVCH0ST.EXE	31

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SVCH0ST.EXE	4.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SVCH0ST.EXE	4.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2356	2792	84ba6f93d1d9b0cd60bf0c4930845fb5.exe	9
PID 2792 wrote to memory of 2356	2792	84ba6f93d1d9b0cd60bf0c4930845fb5.exe	9
PID 2792 wrote to memory of 2356	2792	84ba6f93d1d9b0cd60bf0c4930845fb5.exe	9
PID 2792 wrote to memory of 2356	2792	84ba6f93d1d9b0cd60bf0c4930845fb5.exe	9
PID 2356 wrote to memory of 2568	2356	4.exe	32
PID 2356 wrote to memory of 2568	2356	4.exe	32
PID 2356 wrote to memory of 2568	2356	4.exe	32
PID 2356 wrote to memory of 2568	2356	4.exe	32
PID 2568 wrote to memory of 2740	2568	SVCH0ST.EXE	31
PID 2568 wrote to memory of 2740	2568	SVCH0ST.EXE	31
PID 2568 wrote to memory of 2740	2568	SVCH0ST.EXE	31
PID 2568 wrote to memory of 2740	2568	SVCH0ST.EXE	31
PID 2568 wrote to memory of 2740	2568	SVCH0ST.EXE	31
PID 2568 wrote to memory of 2740	2568	SVCH0ST.EXE	31
PID 2356 wrote to memory of 1096	2356	4.exe	30
PID 2356 wrote to memory of 1096	2356	4.exe	30
PID 2356 wrote to memory of 1096	2356	4.exe	30
PID 2356 wrote to memory of 1096	2356	4.exe	30

C:\Users\Admin\AppData\Local\Temp\84ba6f93d1d9b0cd60bf0c4930845fb5.exe
"C:\Users\Admin\AppData\Local\Temp\84ba6f93d1d9b0cd60bf0c4930845fb5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c erase /F C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
    3⤵
    PID:1096
- - C:\Program Files\Common Files\Microsoft Shared\MSINFO\SVCH0ST.EXE
    "C:\Program Files\Common Files\Microsoft Shared\MSINFO\SVCH0ST.EXE"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2568

C:\Windows\SysWOW64\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SVCH0ST.EXE

Path C:\Program Files\Common Files\Microsoft Shared\MSINFO\SVCH0ST.EXE
Size 146KB
SHA256 0568bec9cd8f6368f818849546f891d12090072ad8a1ce3d9db1f2c38a2b49d2
MD5 0603179aba37dad6b7a39750459297fb
SHA1 4742d2e65b2ffad6eec36560b0387b6a53aebd7d
SHA512 8281af93b9e6fac79476e3af572b75c0f443b19755fd6c1a4e061d7d128de0dd9837040c7e9c7c62e70ece7f4fb97bd4343a0e271804d35332cbd6c352aec553
SSDEEP 3072:4Qz9ZfFfig/LY4/KIgmTFc5MlfLrpVzS1shrb79EwukBCiTOzmeYoa0xKAn:4UfFr/v7L1lfnewuiTOzmeYoaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SVCH0ST.EXE

Path C:\Program Files\Common Files\Microsoft Shared\MSInfo\SVCH0ST.EXE
Size 155KB
SHA256 c891d7cfac045d7b1bffb22fb4136b7e54c06fa8e6a010fb0e8157392e11e85d
MD5 cd3f1d4105c7aa669b5e949db4a45179
SHA1 8c73220d0ae0816dff26c26c2298f49b92c1658d
SHA512 74df2160a66bd9d9f8dfc916cb22b78e3933979eabee4fc392cbcdfd06f25e735669407f0f9ef6cc65d40652a62db7f58d8c028224bd58d6732e9b084bf946ce
SSDEEP 3072:4Qz9ZfFfig/LY4/KIgmTFc5MlfLrpVzS1shrb79EwukBCiTOzmeYoa0xKAIAz:4UfFr/v7L1lfnewuiTOzmeYoana
MD5 SHA1 SHA512 SSDEEP

Submit Download

4.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
Size 552KB
SHA256 3beccfa8b2e331965c1f8c37704c4f7123b281e0f999400e13ef0b8833324900
MD5 a7ab3eefb035dc4d79241bc0ab252892
SHA1 8b584a92eb07a39f2166a140519ad50da0600457
SHA512 1b4f01d5729f01deadea63a44ea84fe3e4405be3497eccfd432a08203ff747a4826ba824383f030146435e22bb5c8b202655e72370258ef733ce2cf429dab451
SSDEEP 12288:bp/v7L1lfnewMyLoNprhcEIPCX0Db2M5SMRnn2:bFDLpM0oqEW1DLsn
MD5 SHA1 SHA512 SSDEEP

Submit Download

4.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
Size 490KB
SHA256 87564a299aab64b3ba1d7ff52a454906e8b269c44328fec524b9e5b905cee707
MD5 4c3e7a2b920f704a42e8615602ab5ba8
SHA1 c2ff191f86bdb9677b1b1c008c618d83ad141ef7
SHA512 63b7054424e2af298931188073dbb13bba5a9f7cb9b95b57f457851d121daea1952dc6f8b3b0979dea4bfb3e838f01f1fd622ed73951c28f2c3eeaa226ca4377
SSDEEP 12288:bp/v7L1lfnewMyLoNprhcEIPCX0Db2M54:bFDLpM0oqEW1DLS
MD5 SHA1 SHA512 SSDEEP

Submit Download

4.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
Size 524KB
SHA256 ca86c6d4fa87457d3822015f7b6339f9104bbf7a0548db466943ebf155918310
MD5 ef63b561f852427200db4259987bec75
SHA1 08a630e1f9deb5b1c710166acbef652f165bf9e8
SHA512 7ef20fb3aed3ca2c782995e76a3fcc1bb1cbba2acdd6b8295ac6ab4d9f414974b19ef83c7e8abc3148a64803e5f66311dcb2f06cbf6f183dcbc59feb02a63a69
SSDEEP 12288:bp/v7L1lfnewMyLoNprhcEIPCX0Db2M5SMRw:bFDLpM0oqEW1DLs9
MD5 SHA1 SHA512 SSDEEP

Submit Download

SVCH0ST.EXE

Path \Program Files\Common Files\Microsoft Shared\MSInfo\SVCH0ST.EXE
Size 145KB
SHA256 e5bb4223127840fd6f631ab540859bbaaa52acaf3b4f8eef4f3cdddc726fc6f3
MD5 0bace1bce74d16a0bf5f2bc55f071701
SHA1 d899549742d6d57c3319f07c47d1bccfddf8c10b
SHA512 14d3eba3879136e690ce05e435979610e33d9c1def19fbba0c2b6d312a7da2340d2ada75018232794a4d7c37da4df3cc25a4dea13109f25be282fab4b0cd22b1
SSDEEP 3072:4Qz9ZfFfig/LY4/KIgmTFc5MlfLrpVzS1shrb79EwukBCiTOzmeYoa0xKA4:4UfFr/v7L1lfnewuiTOzmeYoa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

SVCH0ST.EXE

Path \Program Files\Common Files\Microsoft Shared\MSInfo\SVCH0ST.EXE
Size 212KB
SHA256 191bbadb3575e506eb981ae09bda94d3f87b22fd9e5ebeedbc076c8380cc55c8
MD5 f2903290d35fb0f0d7b30dc12983b2ce
SHA1 1e10bfa614159cb13e67bdbcab39b2ad39deae05
SHA512 a0cce06721ba9dd2f0c1102b17c1cb769b1cf5f5dcd76849b348d55f4d1d9741f49933997477d16d50040606fc27c6066c8dcca2795ffd8b6e09218035bcfad1
SSDEEP 3072:4Qz9ZfFfig/LY4/KIgmTFc5MlfLrpVzS1shrb79EwukBCiTOzmeYoa0xKAIAm5fc:4UfFr/v7L1lfnewuiTOzmeYoandxZVu
MD5 SHA1 SHA512 SSDEEP

Submit Download

4.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
Size 509KB
SHA256 71c861ae5b9e0f348d6ee587f13b1485de0013914f289908879d8d2cc92f6861
MD5 ecfb05c5001661f879472416ebe7eec1
SHA1 6b0b8c0087a747787b6bca17ce04ef181ffa49b0
SHA512 f1da7a671f153cec9e1f09cfe31596a111544db01df9a5b8d74be7f4c63e8c6348b4b95827514ca801c9ec5c3a4aeddb095ae3742ad92b5f4ef901995f2f6431
SSDEEP 12288:bp/v7L1lfnewMyLoNprhcEIPCX0Db2M5SMO:bFDLpM0oqEW1DLsJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

4.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
Size 483KB
SHA256 927a8211a65a178e05c15856d219ee38793e81d04b2966fe232e3f1e748fcf6e
MD5 383d618b623c9816f30fdb3222776f38
SHA1 4989d9b610d15b9d980bf0ef02012c4531695429
SHA512 566d02a87092cff97093969fec8dd36844588412cca879c79b8a7a5856f685c666ff802b4252b21afb921e33298487e9b4ea7dc1d1664503708c651a34616637
SSDEEP 12288:bp/v7L1lfnewMyLoNprhcEIPCX0Db2M5l:bFDLpM0oqEW1DLr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2356-55-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2356-22-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/2568-46-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/2568-54-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2740-51-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2740-49-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2740-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2792-5-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/2792-1-0x0000000000210000-0x0000000000264000-memory.dmp

Download

memory/2792-4-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/2792-0-0x0000000001000000-0x000000000110B000-memory.dmp

Download

memory/2792-6-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/2792-57-0x0000000000210000-0x0000000000264000-memory.dmp

Download

memory/2792-7-0x0000000000840000-0x0000000000841000-memory.dmp

Download

memory/2792-56-0x0000000001000000-0x000000000110B000-memory.dmp

Download

memory/2792-14-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/2792-9-0x00000000008A0000-0x00000000008A1000-memory.dmp

Download

memory/2792-10-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/2792-11-0x0000000000860000-0x0000000000861000-memory.dmp

Download

memory/2792-12-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/2792-13-0x0000000000920000-0x0000000000922000-memory.dmp

Download

memory/2792-8-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads