modiloader | adebfbc5cf6271c6531008b7c566ba35330c9e3c6a7c2f972491b2819c6e2e3d

General

Target

f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
Size

697KB
MD5

8ef8e5533d86648c801d64b6482d5812
SHA1

1ae6d02ecf83a889c1f7f0b195a040daf2e03cd0
SHA256

f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a
SHA512

709928d8084606d35e9bc28a8b153d9b8af48751688bd00704e82107706e15c77e7d998306d9966fa91ba60ffdc8f651cd3e5e84b09d70625127f9d8ce0a36a6
SSDEEP

12288:t92HGEyVAYJC3+GRx/UsGUjnXTUfj34vZYUJtF3Z4mxxfSM1tYWig+Ayale8W:t1TIbzGCXTUr34vZYUJtQmXfSQyXg+bj

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 9 IoCs

resource	yara_rule
behavioral1/memory/1900-14-0x0000000000400000-0x0000000000526000-memory.dmp	modiloader_stage2
behavioral1/memory/1900-21-0x0000000000400000-0x0000000000526000-memory.dmp	modiloader_stage2
behavioral1/memory/1900-32-0x0000000000400000-0x0000000000526000-memory.dmp	modiloader_stage2
behavioral1/memory/1900-39-0x0000000004490000-0x00000000045B6000-memory.dmp	modiloader_stage2
behavioral1/memory/2432-44-0x0000000000400000-0x0000000000526000-memory.dmp	modiloader_stage2
behavioral1/memory/1900-58-0x0000000000400000-0x0000000000526000-memory.dmp	modiloader_stage2
behavioral1/memory/1900-68-0x0000000000400000-0x0000000000526000-memory.dmp	modiloader_stage2
behavioral1/memory/2432-70-0x0000000000400000-0x0000000000526000-memory.dmp	modiloader_stage2
behavioral1/memory/2432-71-0x0000000000400000-0x0000000000526000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
1212	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2432	Svchost.ra

Loads dropped DLL 5 IoCs

pid	Process
1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
2548	WerFault.exe
2548	WerFault.exe
2548	WerFault.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\M:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\Q:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\V:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\W:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\Y:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\E:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\K:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\U:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\X:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\B:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\G:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\J:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\L:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\O:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\P:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\T:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\Z:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\H:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\I:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\N:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\R:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened (read-only)	\??\S:	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\AutoRun.inf	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened for modification	C:\AutoRun.inf	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File created	F:\AutoRun.inf	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened for modification	F:\AutoRun.inf	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_Svchost.ra	Svchost.ra
File opened for modification	C:\Windows\SysWOW64\_Svchost.ra	Svchost.ra

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 2688	2432	Svchost.ra	31

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Svchost.ra	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Svchost.ra	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	2432	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svchost.ra
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2432	1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe	30
PID 1900 wrote to memory of 2432	1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe	30
PID 1900 wrote to memory of 2432	1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe	30
PID 1900 wrote to memory of 2432	1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe	30
PID 2432 wrote to memory of 2688	2432	Svchost.ra	31
PID 2432 wrote to memory of 2688	2432	Svchost.ra	31
PID 2432 wrote to memory of 2688	2432	Svchost.ra	31
PID 2432 wrote to memory of 2688	2432	Svchost.ra	31
PID 2432 wrote to memory of 2688	2432	Svchost.ra	31
PID 2432 wrote to memory of 2688	2432	Svchost.ra	31
PID 2432 wrote to memory of 2548	2432	Svchost.ra	32
PID 2432 wrote to memory of 2548	2432	Svchost.ra	32
PID 2432 wrote to memory of 2548	2432	Svchost.ra	32
PID 2432 wrote to memory of 2548	2432	Svchost.ra	32
PID 1900 wrote to memory of 1212	1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe	33
PID 1900 wrote to memory of 1212	1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe	33
PID 1900 wrote to memory of 1212	1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe	33
PID 1900 wrote to memory of 1212	1900	f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe	33

C:\Users\Admin\AppData\Local\Temp\f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe
"C:\Users\Admin\AppData\Local\Temp\f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\Svchost.ra
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Svchost.ra"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 268
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\DelSvel.bat

Filesize
248B

MD5
f22a80440381f9e9518dafd86efdfde8

SHA1
53c5eb6ff6d7b86a74ac65554184be0c0fd90a50

SHA256
3ae9fa1957b1478fdc4c4ffa639415071cd344761b9c6b19748083d4d42c3450

SHA512
59011aab844bae869a63ed341498e87159f6a0d56913eeb44b023d1eb896c0a4edd091a3f107c9d4d8b7491e62dedd6d9bf8c5c4dbbd0dcb54fa8509d30a0720

Download Submit
F:\Svchost.ra

Filesize
697KB

MD5
8ef8e5533d86648c801d64b6482d5812

SHA1
1ae6d02ecf83a889c1f7f0b195a040daf2e03cd0

SHA256
f948dc3ae5917be2f82b9b5976c2caa58aabff47764221082f0ff26db0e74f2a

SHA512
709928d8084606d35e9bc28a8b153d9b8af48751688bd00704e82107706e15c77e7d998306d9966fa91ba60ffdc8f651cd3e5e84b09d70625127f9d8ce0a36a6

Download Submit
memory/1900-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1900-17-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1900-1-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/1900-2-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1900-16-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/1900-15-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/1900-13-0x0000000003240000-0x0000000003242000-memory.dmp

Filesize
8KB

Download
memory/1900-12-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1900-11-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1900-10-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/1900-9-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1900-8-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1900-7-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1900-6-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1900-5-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1900-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1900-18-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1900-20-0x00000000004C6000-0x00000000004C7000-memory.dmp

Filesize
4KB

Download
memory/1900-19-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/1900-21-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1900-14-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1900-32-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1900-68-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1900-40-0x0000000004490000-0x00000000045B6000-memory.dmp

Filesize
1.1MB

Download
memory/1900-39-0x0000000004490000-0x00000000045B6000-memory.dmp

Filesize
1.1MB

Download
memory/1900-0-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1900-59-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/1900-58-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2432-44-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2432-43-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2432-42-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2432-70-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2432-71-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2688-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2688-51-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads