modiloader | d332b30a7b418766c6fe19d1329051af4a71ce2ea09ea8ea9bbbb222dd2a5658

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cfabaci_Signed_.exe
Size

960KB
MD5

8b2b400d37fdc9121b819ebd2beef307
SHA1

0d303ae14fbb7df8d07c2d24c0a2a66ff05eafc4
SHA256

7a8468cf315b63bc201f82a3318b39481bba571fdc30b601728faa1bd048dffd
SHA512

e1badcf19684a5e1162cdf5fc4939753c4dda1aaf0cbf47376370c31a13c2159abfb30f6ef12fe5b5f338bb29b2b74327ec5e71079ae780ecd1da54a2b72f5f8
SSDEEP

12288:dY2jsH0s30vuwlPMSGUzoPLLJ3SSsD8O1sXNn5IusLZQ1O:dzjm02wKazmLF6s9V1Y

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader First Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1940-4-0x0000000000540000-0x0000000000550000-memory.dmp	modiloader_stage1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2568	1940	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfabaci_Signed_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2568	1940	Cfabaci_Signed_.exe	31
PID 1940 wrote to memory of 2568	1940	Cfabaci_Signed_.exe	31
PID 1940 wrote to memory of 2568	1940	Cfabaci_Signed_.exe	31
PID 1940 wrote to memory of 2568	1940	Cfabaci_Signed_.exe	31

C:\Users\Admin\AppData\Local\Temp\Cfabaci_Signed_.exe
"C:\Users\Admin\AppData\Local\Temp\Cfabaci_Signed_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1408
  2⤵
  - Program crash
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1940-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1940-1-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1940-4-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/1940-10-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download