modiloader | c9c08642e0b5db94773fdb8847ca4a3915d1626ed1d3e0efa11fdae3e2b74d4e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TextPic.exe
Size 671KB
Sample240421-e8vq4abd44
SHA256 5ddfe98d00b60e8de5ab8433016ffa63e1860bcf3dbe5ce76560cc7c3e79a674
MD5 c3bc3e30cc02eb0ef024dfb667f4b7e4
SHA1 1b4a0cb2d55e31ef08300f9699b867c8c1425c0e
SHA512 93f9cdec815f8a85512e4415f48b903570e8f4eea6cebac4cec0b7cc552b79dbd38c7dadfd1ed02f3d3837a6da6d9334a415d8c477fc97ab243c9a0b9a5e2169
SSDEEP 12288:GVZjRjcFHrPJ4rPKEwzf1HD28BOto5jteU2EWKHJmz+qnBC27XKgj4a:a1ijWK9f1HD28BOtc0D+Had4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4168-4-0x0000000000600000-0x00000000006AE000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	TextPic.exe

Loads dropped DLL 1 IoCs

pid	Process
3004	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msext31.dll	TextPic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29FAF023-FCF6-483A-AAF0-D88D5E76A025}\InprocServer32\ = "C:\\Windows\\SysWow64\\msext31.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29FAF023-FCF6-483A-AAF0-D88D5E76A025}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\*\shellex	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\*\shellex\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ContMenu\ = "{29FAF023-FCF6-483A-AAF0-D88D5E76A025}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29FAF023-FCF6-483A-AAF0-D88D5E76A025}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29FAF023-FCF6-483A-AAF0-D88D5E76A025}\ = "zdplugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29FAF023-FCF6-483A-AAF0-D88D5E76A025}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\*\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\*\shellex\ContextMenuHandlers\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ContMenu	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4168	TextPic.exe
4168	TextPic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4168	TextPic.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3004	4168	TextPic.exe	85
PID 4168 wrote to memory of 3004	4168	TextPic.exe	85
PID 4168 wrote to memory of 3004	4168	TextPic.exe	85

C:\Users\Admin\AppData\Local\Temp\TextPic.exe
"C:\Users\Admin\AppData\Local\Temp\TextPic.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msext31.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msext31.dll

Path C:\Windows\SysWOW64\msext31.dll
Size 137KB
SHA256 906c225e57fdee864de095116e5a07545931bd5e1f5b97395ec16d93ba53a443
MD5 653892fa0067265df4f28c82322fac79
SHA1 dea3993e7ad383c6222a4e94d7cf98178a6506f1
SHA512 e4bef1882bf7d959461c6d3f96b4860bdfdd0947bcd1608ed13b8b5c3c417ea4bdfde2676a9900c1c0d9b2dd1f42547547a9564c55883a5740ac691abb677d60
SSDEEP 3072:FGYmMZ03EGiAaGj1r9DHAkbTpIbhf2CUXe/3heZ8JL:4NlaG3TbkH3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4168-0-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/4168-4-0x0000000000600000-0x00000000006AE000-memory.dmp

Download

memory/4168-6-0x0000000002240000-0x0000000002241000-memory.dmp

Download