modiloader | 23f7c5d14aaec20050a61d9a45651ec51603ec1902ac8736ac86ea85b7076d05

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2bc3a1b9721fd19cf65a8970fc87282f.exe
Size 1.4MB
Sample240222-bra4kshg7v
SHA256 23f7c5d14aaec20050a61d9a45651ec51603ec1902ac8736ac86ea85b7076d05
MD5 2bc3a1b9721fd19cf65a8970fc87282f
SHA1 b1fe73eeafdb044382a2f1cdef6cd055be7a4730
SHA512 400d82db80c5c2bc125033fe8dd3dd1d12cbdcc58ccde512b03d416e1c031c37ac33315a974ac66782cb7d7e93d70b7cafc799fa17f1c3a10878f396c91df140
SSDEEP 24576:BYpbarLJ08L0lk4A7YRHT6TLmqAEaQpM1GL3LW87:BYpuYk4BHVdEaQpM1GL3LJ7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3500-2-0x0000000003080000-0x0000000004080000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
3888	skype.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2200714112-3788720386-2559682836-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ijxklvgg = "C:\\Users\\Public\\Ijxklvgg.url"	2bc3a1b9721fd19cf65a8970fc87282f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2200714112-3788720386-2559682836-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-RKZKPL = "\"C:\\Windows\\SysWOW64\\skype\\skype.exe\""	colorcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-RKZKPL = "\"C:\\Windows\\SysWOW64\\skype\\skype.exe\""	colorcpl.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\skype\skype.exe	colorcpl.exe
File opened for modification	C:\Windows\SysWOW64\skype\skype.exe	colorcpl.exe
File opened for modification	C:\Windows\SysWOW64\skype	colorcpl.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	colorcpl.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 564	3500	2bc3a1b9721fd19cf65a8970fc87282f.exe	87
PID 3500 wrote to memory of 564	3500	2bc3a1b9721fd19cf65a8970fc87282f.exe	87
PID 3500 wrote to memory of 564	3500	2bc3a1b9721fd19cf65a8970fc87282f.exe	87
PID 3500 wrote to memory of 564	3500	2bc3a1b9721fd19cf65a8970fc87282f.exe	87
PID 564 wrote to memory of 3888	564	colorcpl.exe	88
PID 564 wrote to memory of 3888	564	colorcpl.exe	88
PID 564 wrote to memory of 3888	564	colorcpl.exe	88

C:\Users\Admin\AppData\Local\Temp\2bc3a1b9721fd19cf65a8970fc87282f.exe
"C:\Users\Admin\AppData\Local\Temp\2bc3a1b9721fd19cf65a8970fc87282f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\colorcpl.exe
  C:\Windows\System32\colorcpl.exe
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\skype\skype.exe
    "C:\Windows\SysWOW64\skype\skype.exe"
    3⤵
    - Executes dropped EXE
    PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

skype.exe

Path C:\Windows\SysWOW64\skype\skype.exe
Size 84KB
SHA256 2e5e0b8fe1c6a6314145e404c46acc4ff227ad63d0f2765d5458d0c4cb80c110
MD5 db71e132ebf1feb6e93e8a2a0f0c903d
SHA1 7e9b267faee4593df44e41b0a5fb900de62060fb
SHA512 9f3b00a452b5d528ac27ec0d100a938753a70a300e7eadc40a3e4456c6223fd8d61393d3ee6995f2d6d0adec4ae48296b4c04abb89a28fecf82dec5b0975583e
SSDEEP 1536:fPbIPfSbS9vMBN7rQOJ7CFToTCzhcRguhwxTyPCb3lZpdym4dy7p:nEXlvq7jSP1cR2prbpdCY9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3500-0-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/3500-1-0x0000000003080000-0x0000000004080000-memory.dmp

Download

memory/3500-2-0x0000000003080000-0x0000000004080000-memory.dmp

Download

memory/3500-4-0x0000000000400000-0x0000000000577000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads