modiloader | aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11/12/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe
Size

481KB
MD5

dbbc479bc4e24a676bdbf2176e47e80e
SHA1

d261fb93dd25221a7e8e84a3787ecf7f5fc84816
SHA256

aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac
SHA512

2a107f9b17c086ad1df474129afba7652f525e03e4e382dabbe1251cce8e72ccebf8d0555d4cb37ff04fdd774c7e1fc0af9317da9d119d6d040d0c553c703ee9
SSDEEP

12288:X+CL63PoVmLamC54ycpsKVWHYIS3O6/FeN7mNtTird:XJL6/nBCG/pvV+SV/FeNmTEd

Score

10^/10

modiloader bootkit discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2956-12-0x0000000000400000-0x000000000054B000-memory.dmp	modiloader_stage2

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt	aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2876	2956	aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe	31
PID 2956 wrote to memory of 2876	2956	aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe	31
PID 2956 wrote to memory of 2876	2956	aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe	31
PID 2956 wrote to memory of 2876	2956	aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe	31

C:\Users\Admin\AppData\Local\Temp\aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe
"C:\Users\Admin\AppData\Local\Temp\aa9e873e603834eb71ab070667b0efa18a01088f3752cfd496568971928804ac.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-0-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2956-1-0x0000000000350000-0x0000000000393000-memory.dmp

Filesize
268KB

Download
memory/2956-6-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/2956-7-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2956-5-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2956-8-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2956-4-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2956-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2956-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2956-10-0x0000000000415000-0x0000000000416000-memory.dmp

Filesize
4KB

Download
memory/2956-13-0x0000000000350000-0x0000000000393000-memory.dmp

Filesize
268KB

Download
memory/2956-12-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads