modiloader | e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MassSender.exe
Size

2.2MB
MD5

88f65230b988517b529f15ee1f173b3c
SHA1

5dd29ced644415f87d106b340eba656eb9eae311
SHA256

e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e
SHA512

46ac27d80b61939f0fef7d5493866274f95494bcfb855751d8b82d6677ef2aef1d6fc9f26b1dbeb217277abe4408ccbc3c75dfc37bc552f31085dc31e99e0c91
SSDEEP

49152:4n7JG9CyViR+Y9ZYVCiIrNDctSXXEeXzAAAL:yV+C0nYoItyg9AL

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1600-3-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral1/memory/1600-7-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral1/memory/1600-9-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral1/memory/1600-11-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral1/memory/1600-13-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1

Modifies registry class 6 IoCs

Processes:

MassSender.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info\Data = 00629f7724629f776bfac27858fa180098fa9d778cf918001cf91800aafa9d7798fa1800cd1ea37787cd440ffeffffff24629f77fc1e5576340000c00d097676e4fa1800091f55762001000080fa180088fa18006ce39e7784fa180002000000000000000000000020010000000000008cf91800340000c05801220000000000b02e220000000000080018086e00740088392200000000005c00520045004700490053005400520059005c004d004100000000000000a0000843a50053006f006600740025000e00020000005c0043004c00410053005300a842a500010000000043a50010fa180003e09e77e4fa180058fa1800000000000043a50024fa180088e69e770000a000000000000843a50034fa1800ba34d6a2e20b00001420120826a27a7e60fa18000005a277ba34d6a2260c00000eb967faeb50d7c61a00000000000000000000009cfa18000000000080fa1800050000000d000000962b690017000000ba0ce002e8071801b4fa18009e2a6900acfa1800f2020000ecfa1800cc2a6900d42a6900fc55380258d4390258d4390204322e30305eb559a7dde13f0f0000008c2f6900f2021800b559a7ddb559a7dd1130e64001000d000d001700	MassSender.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info	MassSender.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	MassSender.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	MassSender.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}	MassSender.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info	MassSender.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MassSender.exe

pid process

1600 MassSender.exe
1600 MassSender.exe
1600 MassSender.exe

pid	process
1600	MassSender.exe
1600	MassSender.exe
1600	MassSender.exe

C:\Users\Admin\AppData\Local\Temp\MassSender.exe
"C:\Users\Admin\AppData\Local\Temp\MassSender.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1600

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-0-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1600-1-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1600-2-0x00000000037F0000-0x00000000037F1000-memory.dmp

Filesize
4KB

Download
memory/1600-3-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1600-5-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1600-6-0x00000000037F0000-0x00000000037F1000-memory.dmp

Filesize
4KB

Download
memory/1600-7-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1600-9-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1600-11-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1600-12-0x0000000003B00000-0x0000000003B01000-memory.dmp

Filesize
4KB

Download
memory/1600-13-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1600-15-0x0000000003B00000-0x0000000003B01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads