modiloader | 5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe
Size

692KB
MD5

a93e709ed51db89d5032474ee3e3aafe
SHA1

5703c9977cb27c0a84b8ff5e610cd4c278c4a9f8
SHA256

5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f
SHA512

6fc2b582726150df58072146ee5b06cca626ba696cd491b769072c6a09480b04b0fe541ef14cc9266429cb7e564d2998c4f51fc09b558392bd0171e1bceafeac
SSDEEP

12288:5RRtGgozqi5paO0lp9USQVUSyrkA4pZ6J+v5NdTgxWaSTA1:rf2eas1USImapIwPuIaSTm

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral2/memory/780-0-0x0000000000400000-0x00000000004B8000-memory.dmp	modiloader_stage2
behavioral2/files/0x0009000000023c64-4.dat	modiloader_stage2
behavioral2/memory/780-9-0x0000000000400000-0x00000000004B8000-memory.dmp	modiloader_stage2
behavioral2/memory/3504-8-0x0000000000400000-0x00000000004B8000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
3504	svchsot.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchsot.exe	svchsot.exe
File created	C:\Windows\SysWOW64\DaverDel.bat	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe
File created	C:\Windows\SysWOW64\svchsot.exe	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe
File opened for modification	C:\Windows\SysWOW64\svchsot.exe	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchsot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 3504	780	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe	85
PID 780 wrote to memory of 3504	780	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe	85
PID 780 wrote to memory of 3504	780	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe	85
PID 780 wrote to memory of 2788	780	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe	86
PID 780 wrote to memory of 2788	780	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe	86
PID 780 wrote to memory of 2788	780	5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe	86

C:\Users\Admin\AppData\Local\Temp\5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe
"C:\Users\Admin\AppData\Local\Temp\5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\svchsot.exe
  C:\Windows\system32\svchsot.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\DaverDel.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DaverDel.bat

Filesize
248B

MD5
f8aa6fe1bd169bf608502d0aff449a50

SHA1
d7496b2ec7ee00a82c632d2c1d6a6414c6122a74

SHA256
7663962cccac264d773e87e4fde1d33719e879e29150517e7d19bfbffa1537e9

SHA512
7770b6932023933619c354338c95c7f913af62c12e3f9a30c36dda0abc04856d198ed1df058fd981fd982f5b8588ecddd4a673386fc76959b579e43624905c7b

Download Submit
C:\Windows\SysWOW64\svchsot.exe

Filesize
692KB

MD5
a93e709ed51db89d5032474ee3e3aafe

SHA1
5703c9977cb27c0a84b8ff5e610cd4c278c4a9f8

SHA256
5771d79e10e40ce1272c45cbd7e27bbd7db3ea9332e1d42e3a7950a1f2dbdf9f

SHA512
6fc2b582726150df58072146ee5b06cca626ba696cd491b769072c6a09480b04b0fe541ef14cc9266429cb7e564d2998c4f51fc09b558392bd0171e1bceafeac

Download Submit
memory/780-0-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/780-9-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3504-8-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download