modiloader | 70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476

Analysis

max time kernel
94s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exe
Size

791KB
MD5

82d8f19d1a4521e86922988eced2e240
SHA1

9d5728039b7444f048787e6c06b095af79d24ff8
SHA256

70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476
SHA512

06eaa34a24a9df9cd2ad800aa5a52588b247c6707fb40a6213b7aaf3f97745aabc2bdb5065c74158ae9480c5dd5f43c6c1a993e87e03fc70d51e250a7c3ac07a
SSDEEP

24576:9bDtVhyrtEYq6pUj8XaHhwtkkIqTf9XnkA16o:7VMtEIyAKQIq1X6o

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/220-9-0x0000000000400000-0x000000000057D000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

WINHEL~1.EXE

pid	Process
220	WINHEL~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exe

Drops file in Program Files directory 1 IoCs

Processes:

WINHEL~1.EXE

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt	WINHEL~1.EXE

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2360	220	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exeWINHEL~1.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINHEL~1.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exeWINHEL~1.EXE

description	pid	Process	procid_target
PID 392 wrote to memory of 220	392	70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exe	83
PID 392 wrote to memory of 220	392	70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exe	83
PID 392 wrote to memory of 220	392	70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exe	83
PID 220 wrote to memory of 3392	220	WINHEL~1.EXE	90
PID 220 wrote to memory of 3392	220	WINHEL~1.EXE	90

C:\Users\Admin\AppData\Local\Temp\70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exe
"C:\Users\Admin\AppData\Local\Temp\70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WINHEL~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WINHEL~1.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 540
    3⤵
    - Program crash
    PID:2360
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 220 -ip 220
1⤵
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WINHEL~1.EXE

Filesize
737KB

MD5
8b8218c4b94e66c49e9e8973967b39d3

SHA1
6bbd54b7d20844f64217c999e697f34d569df899

SHA256
f0a7af7a18424881334c20b061b458285d973b04ea83bf05e3e08e41d81a1b50

SHA512
10d0ac05ae6c0c9c352b8667c1a5f4e94aec5c572c68f87d9b0812e619c732f50cd6ca61c44cd98d3bd02bee41ae16cf24afe0f400b8e163ae695af211b2e013

Download Submit
memory/220-5-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/220-6-0x00000000007E0000-0x0000000000834000-memory.dmp

Filesize
336KB

Download
memory/220-10-0x00000000007E0000-0x0000000000834000-memory.dmp

Filesize
336KB

Download
memory/220-9-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download