modiloader | f334d177546cec1c77a515b15641ded5051b350c1a4441d28d7a45a0c709d6aa

Analysis

max time kernel
64s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cheat_SAMP.exe
Size

397KB
MD5

c0f64b710727e5d1037535100a9ccc0a
SHA1

45e05788d1d25b03c44eb82242d8574b72f7b6a0
SHA256

f334d177546cec1c77a515b15641ded5051b350c1a4441d28d7a45a0c709d6aa
SHA512

45d36ec27a4e0cbe8f752880097ed992fd1ea64d4e3093942660fd4e089e2016670e37e5894c88d5bd6bcb7d0e8b25776e54126fa093509f9f013fbea65bfb23
SSDEEP

6144:cLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXVkP:I+u9nx2GjMY3XKfd/H/9PuP

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1904-1-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2
behavioral1/memory/1904-2-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2
behavioral1/memory/1904-4-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2
behavioral1/memory/1904-5-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2
behavioral1/memory/1904-7-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cheat_SAMP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\cheat_SAMP.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat_SAMP.exe"	cheat_SAMP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cheat_SAMP.exe

pid	process
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe
1904	cheat_SAMP.exe

C:\Users\Admin\AppData\Local\Temp\cheat_SAMP.exe
"C:\Users\Admin\AppData\Local\Temp\cheat_SAMP.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1904

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2984

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1904-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1904-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1904-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1904-4-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1904-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1904-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads