modiloader | e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e

General

Target

e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Size

2.2MB
MD5

88f65230b988517b529f15ee1f173b3c
SHA1

5dd29ced644415f87d106b340eba656eb9eae311
SHA256

e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e
SHA512

46ac27d80b61939f0fef7d5493866274f95494bcfb855751d8b82d6677ef2aef1d6fc9f26b1dbeb217277abe4408ccbc3c75dfc37bc552f31085dc31e99e0c91
SSDEEP

49152:4n7JG9CyViR+Y9ZYVCiIrNDctSXXEeXzAAAL:yV+C0nYoItyg9AL

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Detects executables packed with ASPack 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2576-0-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2576-3-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2576-7-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2576-9-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2576-11-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2576-13-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ModiLoader First Stage 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2576-3-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral1/memory/2576-7-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral1/memory/2576-9-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral1/memory/2576-11-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral1/memory/2576-13-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1

Modifies registry class 6 IoCs

Processes:

e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info\Data = 006261772462617777c2007858fa180098fa5f778cf918001cf91800aafa5f7798fa1800cd1e65779bf5780ffeffffff24626177fc1e3275340000c00d095d76e4fa1800091f32752001000080fa180088fa18006ce3607784fa180002000000000000000000000020010000000000008cf91800340000c09033360000000000602c36000000000066003700640061006200660032006400340061003900350031006500350065002e00650078006500000000000000b4004844b900000000001800001825000e000200000000000000602c360000000000e843b900010000004044b90010fa180003e06077e4fa180058fa1800000000004044b90024fa180088e660770000b400000000004844b90034fa1800689f9ea5e20b000014201208dbfba38060fa180000056477689f9ea5260c00000eb967faeb50d7c61a00000000000000000000009cfa18000000000080fa1800050000000e000000962b690016000000681b8200e8071801b4fa18009e2a6900acfa1800b8020000ecfa1800cc2a6900d42a69005056220004d5230004d5230004322e3030ba3525a843b93f0f0000008c2f6900b8021800a7047528a70475282330e64002000e0002001600	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe

pid	process
2576	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
2576	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
2576	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe

C:\Users\Admin\AppData\Local\Temp\e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
"C:\Users\Admin\AppData\Local\Temp\e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2576

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2576-0-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/2576-2-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/2576-3-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/2576-5-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2576-6-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/2576-7-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/2576-9-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/2576-11-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/2576-12-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/2576-13-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/2576-15-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads