modiloader | 0883c5197c347b82f29c8dbf56ac343d2df2d955b312e322aee79cd9f17f0726

General

Target
xkunyyrlm6yoogqw.exe
Size 805KB
Sample260721-c51f3acy5l
SHA256 0883c5197c347b82f29c8dbf56ac343d2df2d955b312e322aee79cd9f17f0726
MD5 6cad8d5ba9bafae54fca435e40e6979c
SHA1 4c2db834f82b10c0a6387a495753b69d687d29af
SHA512 2daa9531cb35741951a2679af6b9c7cee16865156b3184c0b177b9af5d533f4f5630c6cedcfebfd34fad9cca8a1b0f38486fe5666d10d7b931c6fad3a907daf2
SSDEEP 12288:Y8ce/TueLwfcCW+SSy/9qEs1UAAFWon4gjUCpgG3JJpmfD7BfD5:oiO8+3G9qElkon4boZS3T
TLSH
T10B05C6243B949E41E540193E92BE2618D73260F323176B83371BF7615D44AEEEE2D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  xkunyyrlm6yoogqw.exe
- Size 805KB
- SHA256 0883c5197c347b82f29c8dbf56ac343d2df2d955b312e322aee79cd9f17f0726
- MD5 6cad8d5ba9bafae54fca435e40e6979c
- SHA1 4c2db834f82b10c0a6387a495753b69d687d29af
- SHA512 2daa9531cb35741951a2679af6b9c7cee16865156b3184c0b177b9af5d533f4f5630c6cedcfebfd34fad9cca8a1b0f38486fe5666d10d7b931c6fad3a907daf2
- SSDEEP 12288:Y8ce/TueLwfcCW+SSy/9qEs1UAAFWon4gjUCpgG3JJpmfD7BfD5:oiO8+3G9qElkon4boZS3T
- TLSH
  T10B05C6243B949E41E540193E92BE2618D73260F323176B83371BF7615D44AEEEE2D3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution modiloader persistence privilege_escalation ransomware spyware stealer trojan
- Family: ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Modifies WinLogon for persistence
  persistence
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1