modiloader | 8f6809da5489c4cfb2dfaec013a35fe99e77174b8c463ea8897238820d32de82

General

Target

b6d1b70101acc223420e27aca2e7416b.exe
Size

515KB
MD5

b6d1b70101acc223420e27aca2e7416b
SHA1

31084a3f8cb1240fd50dec4cb83e01365318e507
SHA256

8f6809da5489c4cfb2dfaec013a35fe99e77174b8c463ea8897238820d32de82
SHA512

318acf02b974be41db0d40b39684b792550c043c3636b7c36170d36add19bed0f9829be32f2a520df1a327e2f8c8dbccf81d159ab19d3d9bcbe0e6f3be37d163
SSDEEP

12288:dupri6XGXQyiuONEih7KLQOJtJ+/l19Xgcbtw7szO8p:du1XIV/ih7UQOc1OawAqQ

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral1/memory/2188-9-0x0000000003450000-0x000000000353E000-memory.dmp	modiloader_stage2
behavioral1/memory/2520-20-0x00000000005E0000-0x00000000006C2000-memory.dmp	modiloader_stage2
behavioral1/memory/2188-35-0x0000000003450000-0x000000000353E000-memory.dmp	modiloader_stage2
behavioral1/memory/2520-40-0x00000000030E0000-0x00000000031CE000-memory.dmp	modiloader_stage2
behavioral1/memory/2520-51-0x00000000030E0000-0x00000000031CE000-memory.dmp	modiloader_stage2

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c00000001313a-2.dat	acprotect

Deletes itself 1 IoCs

pid	Process
2844	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2520	rejoice81.exe

Loads dropped DLL 4 IoCs

pid	Process
2188	b6d1b70101acc223420e27aca2e7416b.exe
2188	b6d1b70101acc223420e27aca2e7416b.exe
2188	b6d1b70101acc223420e27aca2e7416b.exe
2520	rejoice81.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_rejoice81.exe	rejoice81.exe
File opened for modification	C:\Windows\SysWOW64\_rejoice81.exe	rejoice81.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 2564	2520	rejoice81.exe	31

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice81.exe	b6d1b70101acc223420e27aca2e7416b.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice81.exe	b6d1b70101acc223420e27aca2e7416b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat	b6d1b70101acc223420e27aca2e7416b.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{4EDB5D3C-5DCA-4C4D-8D89-64C2CF5BD193}	b6d1b70101acc223420e27aca2e7416b.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{4EDB5D3C-5DCA-4C4D-8D89-64C2CF5BD193}\InprocServer64	b6d1b70101acc223420e27aca2e7416b.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID	rejoice81.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{4EDB5D3C-5DCA-4C4D-8D89-64C2CF5BD193}	rejoice81.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID\{4EDB5D3C-5DCA-4C4D-8D89-64C2CF5BD193}\InprocServer64	rejoice81.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node\CLSID	b6d1b70101acc223420e27aca2e7416b.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Wow6432Node	b6d1b70101acc223420e27aca2e7416b.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2520	2188	b6d1b70101acc223420e27aca2e7416b.exe	28
PID 2188 wrote to memory of 2520	2188	b6d1b70101acc223420e27aca2e7416b.exe	28
PID 2188 wrote to memory of 2520	2188	b6d1b70101acc223420e27aca2e7416b.exe	28
PID 2188 wrote to memory of 2520	2188	b6d1b70101acc223420e27aca2e7416b.exe	28
PID 2188 wrote to memory of 2844	2188	b6d1b70101acc223420e27aca2e7416b.exe	29
PID 2188 wrote to memory of 2844	2188	b6d1b70101acc223420e27aca2e7416b.exe	29
PID 2188 wrote to memory of 2844	2188	b6d1b70101acc223420e27aca2e7416b.exe	29
PID 2188 wrote to memory of 2844	2188	b6d1b70101acc223420e27aca2e7416b.exe	29
PID 2520 wrote to memory of 2564	2520	rejoice81.exe	31
PID 2520 wrote to memory of 2564	2520	rejoice81.exe	31
PID 2520 wrote to memory of 2564	2520	rejoice81.exe	31
PID 2520 wrote to memory of 2564	2520	rejoice81.exe	31
PID 2520 wrote to memory of 2564	2520	rejoice81.exe	31
PID 2520 wrote to memory of 2564	2520	rejoice81.exe	31
PID 2520 wrote to memory of 2640	2520	rejoice81.exe	32
PID 2520 wrote to memory of 2640	2520	rejoice81.exe	32
PID 2520 wrote to memory of 2640	2520	rejoice81.exe	32
PID 2520 wrote to memory of 2640	2520	rejoice81.exe	32

C:\Users\Admin\AppData\Local\Temp\b6d1b70101acc223420e27aca2e7416b.exe
"C:\Users\Admin\AppData\Local\Temp\b6d1b70101acc223420e27aca2e7416b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice81.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice81.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2564
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""
  2⤵
  - Deletes itself
  PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\ReDelBat.bat

Filesize
184B

MD5
775e62799e84f1980bdedeff79b49f07

SHA1
744a7a501b52fbe3c9d0fd75ffd55f95cbef4b3f

SHA256
964da3d78d055abac32fb5c6159c266b4841196b8a932d5c742dc9dd5ed31a16

SHA512
9b693158b653319591432e11bc46d8aa278644a12c0cb4e176574caf8de13617bd7d67c39e808b3ca25f647a0080dcad4fe960c1234f4876f9ed08a534d3bec1

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\rejoice81.exe

Filesize
515KB

MD5
b6d1b70101acc223420e27aca2e7416b

SHA1
31084a3f8cb1240fd50dec4cb83e01365318e507

SHA256
8f6809da5489c4cfb2dfaec013a35fe99e77174b8c463ea8897238820d32de82

SHA512
318acf02b974be41db0d40b39684b792550c043c3636b7c36170d36add19bed0f9829be32f2a520df1a327e2f8c8dbccf81d159ab19d3d9bcbe0e6f3be37d163

Download Submit
\Users\Admin\AppData\Local\Temp\~2F0C.~dl1

Filesize
40KB

MD5
d3edc808052c5ac43f8c1e86bf5786dd

SHA1
9c8ea3358be4a1a58ed3b357852adb4b94cc7322

SHA256
fbac391403c134d13e2d3ada815b6410658473df934b9ba1bb105aebc6bfa18f

SHA512
7114148b4db7f0b542e1ff4c0003a75a70aa43fa342ccd8e578518590e6f78b01afc440161f70c8c387a0911aa196ee77676548e6e5203b956c1659f64322e2e

Download Submit
memory/2188-34-0x0000000000580000-0x000000000059F000-memory.dmp

Filesize
124KB

Download
memory/2188-9-0x0000000003450000-0x000000000353E000-memory.dmp

Filesize
952KB

Download
memory/2188-10-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/2188-0-0x00000000005E0000-0x00000000006C2000-memory.dmp

Filesize
904KB

Download
memory/2188-15-0x0000000005910000-0x00000000059F2000-memory.dmp

Filesize
904KB

Download
memory/2188-33-0x00000000005E0000-0x00000000006C2000-memory.dmp

Filesize
904KB

Download
memory/2188-35-0x0000000003450000-0x000000000353E000-memory.dmp

Filesize
952KB

Download
memory/2188-6-0x0000000000580000-0x000000000059F000-memory.dmp

Filesize
124KB

Download
memory/2188-18-0x0000000005910000-0x00000000059F2000-memory.dmp

Filesize
904KB

Download
memory/2520-49-0x00000000005E0000-0x00000000006C2000-memory.dmp

Filesize
904KB

Download
memory/2520-51-0x00000000030E0000-0x00000000031CE000-memory.dmp

Filesize
952KB

Download
memory/2520-40-0x00000000030E0000-0x00000000031CE000-memory.dmp

Filesize
952KB

Download
memory/2520-41-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/2520-20-0x00000000005E0000-0x00000000006C2000-memory.dmp

Filesize
904KB

Download
memory/2520-50-0x00000000001B0000-0x00000000001CF000-memory.dmp

Filesize
124KB

Download
memory/2520-25-0x00000000001B0000-0x00000000001CF000-memory.dmp

Filesize
124KB

Download
memory/2564-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing