modiloader | 7592e0538ab25ad3091fc7c0867886e99f92b18b722618c2f5c31773516c20d2

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare-002babe29772013f178335001aabe1b0.exe
Size 180KB
Sample240202-138xeshbb7
SHA256 7592e0538ab25ad3091fc7c0867886e99f92b18b722618c2f5c31773516c20d2
MD5 002babe29772013f178335001aabe1b0
SHA1 7f56422aa3f0fdb3e9fe2ccc2001c3c6f53f9879
SHA512 10fad60c03936f340dfdfaa392da51ac448bc17de3e6b9fa1093c8ca8fe7b749ef42c6b2796831f89b37198579177c799fe782a296f490fe274a41cb1b800152
SSDEEP 3072:ojO3JSQLLnpLFJiCtJkvcCDF4dmx367mdfcOFVFMyji3Q4we4vjDFi7wVF:oa3JSQvpPaD+dwKCdf/VLji3DwFvQCF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320b-3.dat	modiloader_stage2
behavioral2/memory/3732-8-0x0000000010000000-0x0000000010010000-memory.dmp	modiloader_stage2

Executes dropped EXE 3 IoCs

pid	Process
3732	svchost
2972	svchost
3268	winhost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2972-5-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/files/0x000700000002320e-10.dat	upx
behavioral2/memory/2972-12-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/3268-13-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2972-14-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/3268-17-0x0000000000400000-0x0000000000459000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svchost"	VirusShare-002babe29772013f178335001aabe1b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system1 = "C:\\Windows\\winhost.exe"	VirusShare-002babe29772013f178335001aabe1b0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3732 set thread context of 2972	3732	svchost	87

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost	VirusShare-002babe29772013f178335001aabe1b0.exe
File created	C:\Windows\winhost.exe	VirusShare-002babe29772013f178335001aabe1b0.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3456	2972	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3732	svchost
3732	svchost

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3732	4664	VirusShare-002babe29772013f178335001aabe1b0.exe	86
PID 4664 wrote to memory of 3732	4664	VirusShare-002babe29772013f178335001aabe1b0.exe	86
PID 4664 wrote to memory of 3732	4664	VirusShare-002babe29772013f178335001aabe1b0.exe	86
PID 3732 wrote to memory of 2972	3732	svchost	87
PID 3732 wrote to memory of 2972	3732	svchost	87
PID 3732 wrote to memory of 2972	3732	svchost	87
PID 3732 wrote to memory of 2972	3732	svchost	87
PID 3732 wrote to memory of 2972	3732	svchost	87
PID 4664 wrote to memory of 3268	4664	VirusShare-002babe29772013f178335001aabe1b0.exe	88
PID 4664 wrote to memory of 3268	4664	VirusShare-002babe29772013f178335001aabe1b0.exe	88
PID 4664 wrote to memory of 3268	4664	VirusShare-002babe29772013f178335001aabe1b0.exe	88

C:\Users\Admin\AppData\Local\Temp\VirusShare-002babe29772013f178335001aabe1b0.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare-002babe29772013f178335001aabe1b0.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\svchost
  C:\Windows\svchost
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\svchost
    C:\Windows\svchost
    3⤵
    - Executes dropped EXE
    PID:2972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 448
      4⤵
      Program crash
      PID:3456
- C:\Windows\winhost.exe
  C:\Windows\winhost.exe
  2⤵
  - Executes dropped EXE
  PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2972 -ip 2972
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost

Path C:\Windows\svchost
Size 35KB
SHA256 422002fa549b0bfc1fd954276614c5440e44b9fd36752d542829dc0cf3063a66
MD5 c0e0dcd95a82f8bcdc20a1b81e56dcc6
SHA1 80e5c745bd9313d0a9338ba43d8f9d880f9092fc
SHA512 dc07212ff8a226ee4354728948384943a51a5fcfdcb353ae1622aba7b39a9fe12d09fb140053c03bf4f170c91c7c36646ffd50b44aebbfc56a1b5661842267b3
SSDEEP 768:pyekW8C/gzJM8oMSG/LrXnproowIhN/z2Gl:H78oMSQLLnpLF2Gl
MD5 SHA1 SHA512 SSDEEP

Submit Download

winhost.exe

Path C:\Windows\winhost.exe
Size 135KB
SHA256 b16e48544d8711a029b46f9ad15f1d4ea80885aebb4ef72c1af7c67230fc5376
MD5 d8ade67544d9170ae6a2bd508d3f99f8
SHA1 12d7e044f4f57e573b1c2ae089f0eccd6423600e
SHA512 09ddc3d1971e3fdff64f15a372d55656bfb4ea15d49dfa4340e8624437de8418eb5f240ebc5e4e45350a77edfb0a054f8db318966cdbec515afbd24c4fb115c9
SSDEEP 3072:1iCtJkvcCDF4dmx367mdfcOFVFMyji3Q4we4vjDFi7wVF:1aD+dwKCdf/VLji3DwFvQCF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2972-5-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2972-12-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2972-14-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3268-13-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3268-15-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/3268-17-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3732-8-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/4664-16-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4664-20-0x0000000000400000-0x000000000040A000-memory.dmp

Download