modiloader | e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e

Analysis

max time kernel
142s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Size

2.2MB
MD5

88f65230b988517b529f15ee1f173b3c
SHA1

5dd29ced644415f87d106b340eba656eb9eae311
SHA256

e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e
SHA512

46ac27d80b61939f0fef7d5493866274f95494bcfb855751d8b82d6677ef2aef1d6fc9f26b1dbeb217277abe4408ccbc3c75dfc37bc552f31085dc31e99e0c91
SSDEEP

49152:4n7JG9CyViR+Y9ZYVCiIrNDctSXXEeXzAAAL:yV+C0nYoItyg9AL

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Detects executables packed with ASPack 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1972-0-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1972-3-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1972-7-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1972-11-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1972-13-0x0000000000400000-0x000000000098F000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ModiLoader First Stage 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1972-3-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral2/memory/1972-7-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral2/memory/1972-11-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1
behavioral2/memory/1972-13-0x0000000000400000-0x000000000098F000-memory.dmp	modiloader_stage1

Modifies registry class 6 IoCs

Processes:

e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info\Data = 001ea5760000000000000000090000009b4cb0760826a800090000002c2b9e77906f9f77083ea800101ea576feffff0008fa19001855ad76340000c000000000ccfa19002555ad7664fa1900000000000c0000006cfa190000000000980200000200000070001900000000000000000070f9190000000000eeaa9ea5e20b000014201208cf04a480bcf91900075c0200ee268200d0f9190001000000bcf919003c000000a5a5da01f6fcf48500000000ee268200d0f9190004000000a701000004fa1900c6cd9c7760fa0000b0fa190094c27602e80705000e0002001600090086020200f6fcf485a5a5da019b4cb07600000000000000000000000000000000000000000000000044fa1900b7e5ae7620fa19002cfa190060fa1900fc58750205e6ae76f6fcf485a5a5da012000fe7fe80705000e0002001600090086020200ba68f007000000009cfa190051e5ae7660fa1900050000000e00e907962b690016000000ee268200e80700019cfa19009e2a690094fa190086020000d4fa1900cc2a6900d42a6900fc58750294c2760294c2760204322e30305a81fae445b93f0f0000008c2f690086021900509fbc28509fbc282330e64002000e0002001600	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{237561AB-1162-5837-1307-251216710420}\Info	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe

pid	process
1972	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
1972	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
1972	e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe

C:\Users\Admin\AppData\Local\Temp\e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe
"C:\Users\Admin\AppData\Local\Temp\e8efbb14a3fdb433e11f64993092a18c0c6605ef10f655cdf7dabf2d4a951e5e.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-0-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1972-1-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/1972-2-0x0000000004030000-0x0000000004031000-memory.dmp

Filesize
4KB

Download
memory/1972-3-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1972-5-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/1972-6-0x0000000004030000-0x0000000004031000-memory.dmp

Filesize
4KB

Download
memory/1972-7-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1972-11-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1972-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1972-13-0x0000000000400000-0x000000000098F000-memory.dmp

Filesize
5.6MB

Download
memory/1972-15-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download