modiloader | 80e7ace75ef379afb6d957688242c1d442adc4daeadaffe132b9137ceda00780

Analysis

max time kernel
154s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MyLink/MyLink.exe
Size

231KB
MD5

c34b3901859b5c6199bcdc491eaca1f0
SHA1

19c137ea37fb7a9dce9a40eca7e949684ceb57ce
SHA256

da4968f99d973c41ace39ed70dcc3c39686dc99c5fdf970df953eebd37347a9b
SHA512

9718c0dc517d93a2b276630919d70b89c44e5b3d7fbc347a49c8384a2e7f08b02b332d21723ff9ffe4457951e0d855de03b5b01bc350ab00ca763bd478572df6
SSDEEP

6144:jLFPEhHWgA5AMkXLD4rZVa0bZMSv7L1pK7Mc:jLFchHWgcAMkXLD4dY0bKSTLygc

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
behavioral4/memory/4956-13-0x0000000000400000-0x00000000004A1000-memory.dmp	modiloader_stage1

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MyLink.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MyLink = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MyLink\\MyLink.exe"	MyLink.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MyLink.exe

pid process

4956 MyLink.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

MyLink.exe

pid process

4956 MyLink.exe

pid	process
4956	MyLink.exe

pid	process
4956	MyLink.exe

C:\Users\Admin\AppData\Local\Temp\MyLink\MyLink.exe
"C:\Users\Admin\AppData\Local\Temp\MyLink\MyLink.exe"
1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3868

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4956-0-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4956-13-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4956-15-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download