modiloader | e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27

Analysis

max time kernel
110s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2024, 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe
Size

348KB
MD5

906ac205366ee08598f28907939ae310
SHA1

a9af3927dcf8f5d6d3ccebfd721689c771bed311
SHA256

e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27
SHA512

3a7dbb1984a0845b22e14383e4ac3573a503a136a65ea904c129c9f27632367fb64bc42190b81e2fa073cdfcf7696a36e90263b4fcba9d811b647d9cab1abbb1
SSDEEP

6144:VFjL41SWW+Yta+ySQ+GyoCZUdzlEOVciyGCE+riGDAGxZKcJv6Msx/BGbF:VFjs1SWpY/ySBVoCmdzlEqciy+yiGhZD

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\server.exe\""	server.exe

Modiloader family
modiloader

ModiLoader Second Stage 7 IoCs

resource	yara_rule
behavioral2/memory/3688-35-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral2/memory/3688-34-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral2/memory/3688-36-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral2/memory/3688-29-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral2/memory/3688-48-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral2/memory/2944-59-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral2/memory/2944-67-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05I41M56-QW07-U20F-YX8T-VB4U6TP4UX63}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05I41M56-QW07-U20F-YX8T-VB4U6TP4UX63}\StubPath = "\"C:\\Windows\\server.exe\""	server.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	J3qbFH8P8.exe

Executes dropped EXE 5 IoCs

pid	Process
400	fff2.exe
3068	J3qbFH8P8.exe
3688	J3qbFH8P8.exe
2224	server.exe
2944	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\server = "C:\\Windows\\server.exe"	server.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 3688	3068	J3qbFH8P8.exe	86
PID 2224 set thread context of 2944	2224	server.exe	90

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\server.exe	J3qbFH8P8.exe
File opened for modification	C:\Windows\server.exe	J3qbFH8P8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fff2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	J3qbFH8P8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	J3qbFH8P8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3688	J3qbFH8P8.exe
3688	J3qbFH8P8.exe
2944	server.exe
2944	server.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe
3068	J3qbFH8P8.exe
2224	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 400	4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe	82
PID 4928 wrote to memory of 400	4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe	82
PID 4928 wrote to memory of 400	4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe	82
PID 4928 wrote to memory of 3068	4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe	83
PID 4928 wrote to memory of 3068	4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe	83
PID 4928 wrote to memory of 3068	4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe	83
PID 4928 wrote to memory of 216	4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe	84
PID 4928 wrote to memory of 216	4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe	84
PID 4928 wrote to memory of 216	4928	e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe	84
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 3688	3068	J3qbFH8P8.exe	86
PID 3068 wrote to memory of 1792	3068	J3qbFH8P8.exe	87
PID 3068 wrote to memory of 1792	3068	J3qbFH8P8.exe	87
PID 3068 wrote to memory of 1792	3068	J3qbFH8P8.exe	87
PID 3688 wrote to memory of 2224	3688	J3qbFH8P8.exe	89
PID 3688 wrote to memory of 2224	3688	J3qbFH8P8.exe	89
PID 3688 wrote to memory of 2224	3688	J3qbFH8P8.exe	89
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 2944	2224	server.exe	90
PID 2224 wrote to memory of 1104	2224	server.exe	91
PID 2224 wrote to memory of 1104	2224	server.exe	91
PID 2224 wrote to memory of 1104	2224	server.exe	91
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93
PID 2944 wrote to memory of 1564	2944	server.exe	93

C:\Users\Admin\AppData\Local\Temp\e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe
"C:\Users\Admin\AppData\Local\Temp\e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- C:\fff2.exe
  "C:\fff2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:400
- C:\J3qbFH8P8.exe
  "C:\J3qbFH8P8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\J3qbFH8P8.exe
    "C:\J3qbFH8P8.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\server.exe
      "C:\Windows\server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        5⤵
        Modifies WinLogon for persistence
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1564
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c \melt.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c \melt.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c \melt.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\J3qbFH8P8.exe

Filesize
220KB

MD5
144dec755361311d15dce9b03d368d01

SHA1
4d331cb6d916d997ee0d14faa1ae8dded71b02c8

SHA256
98e284e33c2b8aaa654fe78b5586dbfd10c45b694415c9fe7718feeab4f4ca25

SHA512
d2fa423ca1dd8c6dac906ba640812686d6260120870b5878dcce00ef0d67229872eb6104d1e8caf043d9d8a38d28699c2b491d271f1d16839d631f9102130993

Download Submit
C:\fff2.exe

Filesize
54KB

MD5
116d27fdf50ebecaada14096812dbf90

SHA1
5af91f4129b2e38f8decd50c8b0cc5d09c042bf1

SHA256
3ed5f41bad3acaf3eb8507d61b70c75c84e18febe06ebd482f3c366edcec394c

SHA512
e98eb844f4ddf74cccab1a14ea1a03accc3c2e0daa02aeb32d4718dbbb547ba80dbcd0d8469aed4d0f4fbb6949ddfe5e70fff099651d69d9fe8d2047b54b7c2a

Download Submit
C:\melt.bat

Filesize
287B

MD5
98713d6ef545bfbcf9a1b91593423e69

SHA1
44d1dd7c892af0fc453440e41e417978964d67c5

SHA256
30a22fdf3adb78ebdffec1b10be434957c78ca591cc4f844a65cba91d9328dee

SHA512
642bdef64509c020b8c01ef02ce9465438415979497b0559aec352ec70f9b265cae4fcd00a27db88fe185043d9204ed3e3697afb517bed3baaed98569f2d1685

Download Submit
C:\melt.bat

Filesize
287B

MD5
7950379a75de0933176543eeaf0d2284

SHA1
939e2251125c30bd64453fb75e0d14fe8378c047

SHA256
f922d72e72b2d42ab868274ce13a88db507e554ce534724c2fad24b471cce073

SHA512
6110e37a03074cfb2e529927e9ca71d3180b7a4adb9a1af70ab1b8d0a7bc4f307f089e9fa5f1b7297e844b7235b7ab8a1c5266d45dc069a0bc806a5e3c618eda

Download Submit
memory/400-15-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/400-70-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2944-59-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2944-60-0x0000000010410000-0x0000000010455000-memory.dmp

Filesize
276KB

Download
memory/2944-61-0x0000000010410000-0x0000000010455000-memory.dmp

Filesize
276KB

Download
memory/2944-67-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3688-34-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3688-36-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3688-35-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3688-29-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3688-48-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download