modiloader | bc022d5126b35116dcf601ed4d2db425ef428936d5a109cab6d2d480f988ae61

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2024, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9f9357d3a730163a077aeeca84f465d5.exe
Size 297KB
Sample240216-gdyklsbe23
SHA256 bc022d5126b35116dcf601ed4d2db425ef428936d5a109cab6d2d480f988ae61
MD5 9f9357d3a730163a077aeeca84f465d5
SHA1 8aac592f8e426109b42d1093c17261dd39e77c9a
SHA512 73becfebd18dc5cdf0bbd851b34d51317fcda4a170c893bc05efe6331cfc6e8eaf625b40e68f5bec14fc76523372bad9c6071e427505786b5e055b7e06e7e170
SSDEEP 6144:wwuFuBFRHqwe4mBmRqczBRaNfhQQI9tFG7gKLJsBpHQc5Ur6Y/lt0U:gFuBFVm420fAfNI9it1sBZQN6IKU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 9 IoCs

resource	yara_rule
behavioral2/memory/3992-2-0x0000000000400000-0x00000000004D6200-memory.dmp	modiloader_stage2
behavioral2/memory/3992-3-0x0000000000400000-0x00000000004D6200-memory.dmp	modiloader_stage2
behavioral2/memory/3992-6-0x0000000000400000-0x00000000004D6200-memory.dmp	modiloader_stage2
behavioral2/memory/3992-7-0x0000000000400000-0x00000000004D6200-memory.dmp	modiloader_stage2
behavioral2/memory/1364-13-0x0000000000400000-0x00000000004D6200-memory.dmp	modiloader_stage2
behavioral2/memory/1364-14-0x0000000000400000-0x00000000004D6200-memory.dmp	modiloader_stage2
behavioral2/memory/1364-17-0x0000000000400000-0x00000000004D6200-memory.dmp	modiloader_stage2
behavioral2/memory/3992-23-0x0000000000400000-0x00000000004D6200-memory.dmp	modiloader_stage2
behavioral2/memory/1364-24-0x0000000000400000-0x00000000004D6200-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1364	Se46.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_Se46.exe	Se46.exe
File opened for modification	C:\Windows\SysWOW64\_Se46.exe	Se46.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 3320	1364	Se46.exe	86

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se46.exe	9f9357d3a730163a077aeeca84f465d5.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se46.exe	9f9357d3a730163a077aeeca84f465d5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat	9f9357d3a730163a077aeeca84f465d5.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4128	3320	WerFault.exe	86

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1364	3992	9f9357d3a730163a077aeeca84f465d5.exe	85
PID 3992 wrote to memory of 1364	3992	9f9357d3a730163a077aeeca84f465d5.exe	85
PID 3992 wrote to memory of 1364	3992	9f9357d3a730163a077aeeca84f465d5.exe	85
PID 1364 wrote to memory of 3320	1364	Se46.exe	86
PID 1364 wrote to memory of 3320	1364	Se46.exe	86
PID 1364 wrote to memory of 3320	1364	Se46.exe	86
PID 1364 wrote to memory of 3320	1364	Se46.exe	86
PID 1364 wrote to memory of 3320	1364	Se46.exe	86
PID 1364 wrote to memory of 4992	1364	Se46.exe	88
PID 1364 wrote to memory of 4992	1364	Se46.exe	88
PID 3992 wrote to memory of 5112	3992	9f9357d3a730163a077aeeca84f465d5.exe	90
PID 3992 wrote to memory of 5112	3992	9f9357d3a730163a077aeeca84f465d5.exe	90
PID 3992 wrote to memory of 5112	3992	9f9357d3a730163a077aeeca84f465d5.exe	90

C:\Users\Admin\AppData\Local\Temp\9f9357d3a730163a077aeeca84f465d5.exe
"C:\Users\Admin\AppData\Local\Temp\9f9357d3a730163a077aeeca84f465d5.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se46.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se46.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:3320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 12
      4⤵
      Program crash
      PID:4128
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat""
  2⤵
  PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3320 -ip 3320
1⤵
PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

SgotoDel.bat

Path C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat
Size 184B
SHA256 350e62874950e0f165f4c4d72885fedc7fc3922dd5b87c7f7b9e89bd9fb8e639
MD5 e255254e0e7fd9a6813df8b91829ee5b
SHA1 3516f22302f186d503692ef97f3e32396db09c44
SHA512 bd23e2a59259aeb47ad6622106468b81655784422b132ab4388b5ac2a8bef483fd77f0b3698c3264c18363dfe20852b145bb8225c78faed42eeabb1629be00f3
MD5 SHA1 SHA512

Submit Download

Se46.exe

Path C:\Program Files\Common Files\microsoft shared\MSInfo\Se46.exe
Size 297KB
SHA256 bc022d5126b35116dcf601ed4d2db425ef428936d5a109cab6d2d480f988ae61
MD5 9f9357d3a730163a077aeeca84f465d5
SHA1 8aac592f8e426109b42d1093c17261dd39e77c9a
SHA512 73becfebd18dc5cdf0bbd851b34d51317fcda4a170c893bc05efe6331cfc6e8eaf625b40e68f5bec14fc76523372bad9c6071e427505786b5e055b7e06e7e170
SSDEEP 6144:wwuFuBFRHqwe4mBmRqczBRaNfhQQI9tFG7gKLJsBpHQc5Ur6Y/lt0U:gFuBFVm420fAfNI9it1sBZQN6IKU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1364-19-0x0000000002050000-0x0000000002051000-memory.dmp

Download

memory/1364-14-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/1364-24-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/1364-17-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/1364-12-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/1364-13-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/3320-18-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/3992-8-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/3992-2-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/3992-0-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/3992-3-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/3992-23-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/3992-7-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/3992-1-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

memory/3992-6-0x0000000000400000-0x00000000004D6200-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads