modiloader | 39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaa

General

Target

39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe
Size

769KB
MD5

963a9fe267ddfa91c59eb7dbf190f270
SHA1

9ad43dcbd971d42ebfdba067117f937cd0cb8a7b
SHA256

39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaa
SHA512

0a095c3c30e6fb72fc98706c70e1a2faf164a17d86e87229caffac5c8ca545de19cf02975b7db3c3a36e56c807c77dbebce7107a29718e200e31dff7b3ab1157
SSDEEP

12288:sYC5c18DJqoXVIaRnEFRjYHhCrAaVyly7iVPuNUNc3syNR40CXHKEHoob:Z6JXVFZ2ihUHVyc7iVPbNcO3XHK6b

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 7 IoCs

resource	yara_rule
behavioral1/memory/3064-16-0x0000000000400000-0x0000000000572000-memory.dmp	modiloader_stage2
behavioral1/memory/3064-22-0x0000000000400000-0x0000000000572000-memory.dmp	modiloader_stage2
behavioral1/memory/3064-19-0x0000000000400000-0x0000000000572000-memory.dmp	modiloader_stage2
behavioral1/memory/3064-18-0x0000000000400000-0x0000000000572000-memory.dmp	modiloader_stage2
behavioral1/memory/3064-15-0x0000000000400000-0x0000000000572000-memory.dmp	modiloader_stage2
behavioral1/memory/3064-25-0x0000000000400000-0x0000000000572000-memory.dmp	modiloader_stage2
behavioral1/memory/2764-38-0x0000000000400000-0x0000000000572000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
3064	HackWm.exe
2764	HackWm.exe

Loads dropped DLL 6 IoCs

pid	Process
2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe
2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe
3064	HackWm.exe
2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe
2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe
2764	HackWm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	HackWm.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	HackWm.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HackWm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HackWm.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3064	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	30
PID 2836 wrote to memory of 3064	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	30
PID 2836 wrote to memory of 3064	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	30
PID 2836 wrote to memory of 3064	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	30
PID 2836 wrote to memory of 3064	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	30
PID 2836 wrote to memory of 3064	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	30
PID 2836 wrote to memory of 3064	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	30
PID 3064 wrote to memory of 3004	3064	HackWm.exe	31
PID 3064 wrote to memory of 3004	3064	HackWm.exe	31
PID 3064 wrote to memory of 3004	3064	HackWm.exe	31
PID 3064 wrote to memory of 3004	3064	HackWm.exe	31
PID 3064 wrote to memory of 3004	3064	HackWm.exe	31
PID 3064 wrote to memory of 3004	3064	HackWm.exe	31
PID 3064 wrote to memory of 3004	3064	HackWm.exe	31
PID 2836 wrote to memory of 2764	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	32
PID 2836 wrote to memory of 2764	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	32
PID 2836 wrote to memory of 2764	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	32
PID 2836 wrote to memory of 2764	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	32
PID 2836 wrote to memory of 2764	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	32
PID 2836 wrote to memory of 2764	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	32
PID 2836 wrote to memory of 2764	2836	39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe	32

C:\Users\Admin\AppData\Local\Temp\39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe
"C:\Users\Admin\AppData\Local\Temp\39056f4dabb6c9efacf106b733024d1a22736e6379cd2198cb37a8afbf247aaaN.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HackWm.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HackWm.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:3004
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HackWm.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HackWm.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt

Filesize
57B

MD5
bd20daf2e20a3f4da212741711927dbf

SHA1
41474f669214ee01abce5ff2706027e3c0a15084

SHA256
eb2d64218383deebd531655d23af42e664b30a015f468c4688979fab3e9fe6d3

SHA512
acd374248fda778a013e5b3264e6d7520ca0586bbd281650c97c137e834c32452f17d23bb43e870a47ffa4d3605a8ace681fb76fc117638150cdba65bb05b8b1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\HackWm.exe

Filesize
718KB

MD5
b85134e323e2f85176f45b4f9b9838eb

SHA1
1be4d0cc2dbb7e68931dd31ca9602899a4b1a332

SHA256
978f77482cd7b6e4c1da83263b0a422fb8cff757e802560628f14aa4761e12ba

SHA512
2b94ca0a51a43aaee09454e3fe7cc6e2bbe602df44ac050d2368ed065cbf46878332c31af9046d9e71144dde44b16b3eab19a1a2635a22a838ff9626ba41703b

Download Submit
memory/2764-38-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/2836-9-0x00000000009F0000-0x0000000000B62000-memory.dmp

Filesize
1.4MB

Download
memory/2836-8-0x00000000009F0000-0x0000000000B62000-memory.dmp

Filesize
1.4MB

Download
memory/3064-21-0x00000000004BE000-0x00000000004BF000-memory.dmp

Filesize
4KB

Download
memory/3064-22-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/3064-20-0x0000000000A20000-0x0000000000B92000-memory.dmp

Filesize
1.4MB

Download
memory/3064-19-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/3064-18-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/3064-15-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/3064-14-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/3064-25-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/3064-16-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/3064-11-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads