modiloader | ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb

Sharing

Copy URL Twitter E-mail

General

Target
ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb
Size 297KB
Sample260714-gqechahs8s
SHA256 ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb
MD5 163ef500479b61b5104a0e8a19088c03
SHA1 a96e6201c8f3cbbc4de6662ae1f2c7c5a01ab39a
SHA512 79f1fcc173c2acf1dd754a515479746e327bb1d7a85b080dbe8fc7d2e8909bf352570efbb0b97e5d2f3812da1f12905fbfb0465110b6537795144606896456c2
SSDEEP 3072:zar2xXibKcf5K67+k02XbFbosspwUUgcdgU6GSzP/ot1PYUlBQU7l4vRv179XXlY:Nibl7+k02XZb9UZU6bzP8yb9XViberXO
TLSH
T195545C96BB949CDAD8BAC33584E683297B36F7801743478F192481360F277C5AF7478A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan modiloader

Malware Config

Signatures

Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb

File Explorer

ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb

.exe 297KB

ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb

IMPHASH ae602ececd2a94196c949ced947dec0b
SHA256 ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb
MD5 163ef500479b61b5104a0e8a19088c03
SHA1 a96e6201c8f3cbbc4de6662ae1f2c7c5a01ab39a
SHA512 79f1fcc173c2acf1dd754a515479746e327bb1d7a85b080dbe8fc7d2e8909bf352570efbb0b97e5d2f3812da1f12905fbfb0465110b6537795144606896456c2
SSDEEP 3072:zar2xXibKcf5K67+k02XbFbosspwUUgcdgU6GSzP/ot1PYUlBQU7l4vRv179XXlY:Nibl7+k02XZb9UZU6bzP8yb9XViberXO
TLSH
T195545C96BB949CDAD8BAC33584E683297B36F7801743478F192481360F277C5AF7478A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

ModiLoader Second Stage
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

30:9a:9a:60:4d:3a:5d:be:41:dd:04:3a:73:34:1c:d0:49:6c:72:42:4a:0d:71:fa:f5:af:fe:7e:fe:d1:47:70

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2014

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 1, 2014 - Oct 1, 2015

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:00:4f:ad:e8:54:95:50:28:94:67:00:00:00:00:00:4f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 23, 2014 - Aug 23, 2015

Minor OS version

Major OS version

Entry point

105248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

easinvoker.pdb

advapi32

TraceMessage RegGetValueW OpenProcessToken OpenThreadToken GetTokenInformation MakeAbsoluteSD ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW GetTraceEnableFlags GetTraceLoggerHandle UnregisterTraceGuids GetTraceEnableLevel RegisterTraceGuidsW GetLengthSid CopySid CreateWellKnownSid GetSecurityDescriptorDacl RegOpenKeyExW RegCreateKeyExW RegCloseKey RegQueryInfoKeyW RegEnumValueW RegOpenKeyExA RegQueryValueExA RegDeleteValueW PrivilegeCheck CheckTokenMembership RegSetValueExW EventUnregister EventRegister

kernel32

GetModuleHandleW SetUnhandledExceptionFilter Sleep QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount UnhandledExceptionFilter TerminateProcess LocalAlloc FreeLibrary LoadLibraryExW GetProcAddress CreateFileW GetSystemWindowsDirectoryW HeapAlloc HeapFree GetProcessHeap GetComputerNameExW LocalFree CloseHandle CreateEventW GetLastError GetCurrentThread SetEvent WaitForSingleObject GetCurrentProcess GetVersionExW

msvcrt

??3@YAXPEAX@Z ??2@YAPEAX_K@Z _vsnwprintf _XcptFilter _amsg_exit _wcsnicmp _wcsicmp memcpy _purecall _wtoi __wgetmainargs __set_app_type exit _exit _cexit __setusermatherr _initterm __C_specific_handler _fmode _commode _lock _unlock __dllonexit _onexit ?terminate@@YAXXZ memset

ntdll

RtlSubAuthorityCountSid NtOpenProcessToken RtlCopySid RtlLengthSid RtlGetNtProductType RtlInitUnicodeString RtlSubAuthoritySid RtlInitializeSid RtlDeleteResource RtlReleaseResource RtlAcquireResourceExclusive RtlEqualSid RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtDuplicateToken NtQueryInformationToken NtQuerySystemInformation NtGetCachedSigningLevel RtlInitializeResource NtOpenThreadToken NtClose

ole32

CoReleaseServerProcess CoInitializeSecurity CoTaskMemFree CoTaskMemAlloc CoRevokeClassObject CoRegisterClassObject CoCreateInstance CoInitializeEx CoUninitialize CoAddRefServerProcess

user32

SystemParametersInfoW UpdatePerUserSystemParameters

rpcrt4

RpcBindingCreateW RpcBindingBind I_RpcExceptionFilter RpcSsDestroyClientContext RpcBindingFree RpcStringBindingComposeW RpcBindingFromStringBindingW RpcStringFreeW NdrClientCall3 I_RpcMapWin32Status

samlib

SamFreeMemory SamConnect SamOpenDomain SamCloseHandle SamQuerySecurityObject SamQueryInformationUser SamOpenUser SamQueryInformationDomain

winbio

WinBioGetLogonSetting WinBioGetEnabledSetting WinBioRemoveAllCredentials WinBioGetDomainLogonSetting

samcli

NetUserGetInfo

netutils

NetApiBufferFree

authz

AuthzFreeContext AuthzAccessCheck AuthzAddSidsToContext AuthzInitializeContextFromSid AuthzInitializeResourceManager AuthzFreeResourceManager

Name

.text

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.imrsiv

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb

PE Signature issue

advapi32

kernel32

msvcrt

ntdll

ole32

user32

rpcrt4

samlib

winbio

samcli

netutils

authz

generic