modiloader | f06d83ce130bae96ebfde9adddd0ff1245febf768e6d984b69816b252808ba0c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe
Size

1.0MB
MD5

bef5602089e49d7df0c2544b887d1e04
SHA1

cfa99519b6fa66ce8952c205361cf8e2b53b415a
SHA256

a2c1b716d20b61bc4c57748e1ec195fbac2c5b143cf960d0ffee895160d4b0db
SHA512

2726f63e7298dbb80a069253ba8645fb527a3c4ae5ff4a02a2a7e3319d5b2f81e5c06c6ea7b18a01bdb6e69251df487610bb2db68adab7e6533e15252ffcf342
SSDEEP

24576:+PF6DSSEvVi8ds05OTOfYIOBRaR6URr0GDp6erPEM:+PazuAOfh4RaR6URrNpp

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2808-2-0x0000000003FB0000-0x0000000004FB0000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2904	8240505.exe

Loads dropped DLL 1 IoCs

pid	Process
2904	8240505.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Doteqxzz = "C:\\Users\\Public\\Doteqxzz.url"	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4268 set thread context of 3368	4268	SndVol.exe	56
PID 4268 set thread context of 1428	4268	SndVol.exe	120
PID 1428 set thread context of 3368	1428	sxstrace.exe	56
PID 1428 set thread context of 1824	1428	sxstrace.exe	127

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	sxstrace.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	48	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	50	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1604	powershell.exe
1604	powershell.exe
1604	powershell.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
4268	SndVol.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4268	SndVol.exe
3368	Explorer.EXE
3368	Explorer.EXE
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe
1428	sxstrace.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	powershell.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3368	Explorer.EXE

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3648	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	102
PID 2808 wrote to memory of 3648	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	102
PID 2808 wrote to memory of 3648	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	102
PID 2808 wrote to memory of 1028	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	103
PID 2808 wrote to memory of 1028	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	103
PID 2808 wrote to memory of 1028	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	103
PID 2808 wrote to memory of 3708	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	106
PID 2808 wrote to memory of 3708	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	106
PID 2808 wrote to memory of 3708	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	106
PID 3708 wrote to memory of 2904	3708	cmd.exe	108
PID 3708 wrote to memory of 2904	3708	cmd.exe	108
PID 2904 wrote to memory of 5092	2904	8240505.exe	109
PID 2904 wrote to memory of 5092	2904	8240505.exe	109
PID 5092 wrote to memory of 1680	5092	cmd.exe	111
PID 5092 wrote to memory of 1680	5092	cmd.exe	111
PID 1680 wrote to memory of 1604	1680	cmd.exe	113
PID 1680 wrote to memory of 1604	1680	cmd.exe	113
PID 2808 wrote to memory of 1120	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	114
PID 2808 wrote to memory of 1120	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	114
PID 2808 wrote to memory of 1120	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	114
PID 2808 wrote to memory of 4268	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	115
PID 2808 wrote to memory of 4268	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	115
PID 2808 wrote to memory of 4268	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	115
PID 2808 wrote to memory of 4268	2808	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	115
PID 3368 wrote to memory of 1428	3368	Explorer.EXE	120
PID 3368 wrote to memory of 1428	3368	Explorer.EXE	120
PID 3368 wrote to memory of 1428	3368	Explorer.EXE	120
PID 1428 wrote to memory of 1824	1428	sxstrace.exe	127
PID 1428 wrote to memory of 1824	1428	sxstrace.exe	127

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe
  "C:\Users\Admin\AppData\Local\Temp\BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c mkdir "\\?\C:\Windows "
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c mkdir "\\?\C:\Windows \System32"
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Windows \System32\8240505.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows \System32\8240505.exe
      "C:\Windows \System32\8240505.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5092
      - C:\Windows\system32\cmd.exe
        
        cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
- - C:\Windows\SysWOW64\extrac32.exe
    C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe C:\\Users\\Public\\Libraries\\Doteqxzz.PIF
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\System32\SndVol.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4268
- C:\Windows\SysWOW64\sxstrace.exe
  "C:\Windows\SysWOW64\sxstrace.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3t2wvfo5.g2y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows \System32\8240505.exe

Filesize
128KB

MD5
231ce1e1d7d98b44371ffff407d68b59

SHA1
25510d0f6353dbf0c9f72fc880de7585e34b28ff

SHA256
30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

SHA512
520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

Download Submit
C:\Windows \System32\netutils.dll

Filesize
112KB

MD5
fa7aa88417d0c48807144a1a48fe3fbc

SHA1
6f5ec990b12d4a6075050a94e0d68d03781fa46d

SHA256
2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

SHA512
99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

Download Submit
C:\windows \system32\KDECO.bat

Filesize
11KB

MD5
c545650595b479c81ad6b9d8882aae39

SHA1
7a98aa2e6eee23b3c1bba876955d525bc618b3f0

SHA256
a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9

SHA512
85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

Download Submit
memory/1428-45-0x0000000002810000-0x0000000002B5A000-memory.dmp

Filesize
3.3MB

Download
memory/1428-47-0x00000000025D0000-0x000000000266C000-memory.dmp

Filesize
624KB

Download
memory/1428-46-0x0000000000850000-0x0000000000890000-memory.dmp

Filesize
256KB

Download
memory/1428-49-0x0000000000850000-0x0000000000890000-memory.dmp

Filesize
256KB

Download
memory/1428-42-0x0000000000850000-0x0000000000890000-memory.dmp

Filesize
256KB

Download
memory/1428-43-0x0000000000850000-0x0000000000890000-memory.dmp

Filesize
256KB

Download
memory/1604-24-0x0000018ADE4A0000-0x0000018ADE4C2000-memory.dmp

Filesize
136KB

Download
memory/1604-29-0x00007FF8E2750000-0x00007FF8E3211000-memory.dmp

Filesize
10.8MB

Download
memory/1604-30-0x0000018ADE440000-0x0000018ADE450000-memory.dmp

Filesize
64KB

Download
memory/1604-31-0x0000018ADE440000-0x0000018ADE450000-memory.dmp

Filesize
64KB

Download
memory/1604-34-0x00007FF8E2750000-0x00007FF8E3211000-memory.dmp

Filesize
10.8MB

Download
memory/1824-58-0x0000029FCBF60000-0x0000029FCC053000-memory.dmp

Filesize
972KB

Download
memory/2808-18-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2808-2-0x0000000003FB0000-0x0000000004FB0000-memory.dmp

Filesize
16.0MB

Download
memory/2808-1-0x0000000003FB0000-0x0000000004FB0000-memory.dmp

Filesize
16.0MB

Download
memory/2808-0-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2808-4-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/2904-16-0x00000000613C0000-0x00000000613E3000-memory.dmp

Filesize
140KB

Download
memory/3368-59-0x0000000003190000-0x0000000003269000-memory.dmp

Filesize
868KB

Download
memory/3368-41-0x000000000D780000-0x000000000FB38000-memory.dmp

Filesize
35.7MB

Download
memory/3368-51-0x0000000003190000-0x0000000003269000-memory.dmp

Filesize
868KB

Download
memory/3368-50-0x0000000003190000-0x0000000003269000-memory.dmp

Filesize
868KB

Download
memory/3368-48-0x000000000D780000-0x000000000FB38000-memory.dmp

Filesize
35.7MB

Download
memory/4268-38-0x0000000001000000-0x0000000002000000-memory.dmp

Filesize
16.0MB

Download
memory/4268-44-0x0000000001000000-0x0000000002000000-memory.dmp

Filesize
16.0MB

Download
memory/4268-37-0x000000001ACF0000-0x000000001B03A000-memory.dmp

Filesize
3.3MB

Download
memory/4268-39-0x0000000001000000-0x0000000002000000-memory.dmp

Filesize
16.0MB

Download
memory/4268-40-0x0000000018DE0000-0x0000000018DFD000-memory.dmp

Filesize
116KB

Download