modiloader | 26f2439cf56b5fd64aa2b22519e33aff692bb9af18a24bc3ba1f450840d7a476

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13903a7e289cc092e67b748dfea5389c.exe
Size

489KB
MD5

13903a7e289cc092e67b748dfea5389c
SHA1

5c4c944e6bc42212165379ce8fa707672a5be10d
SHA256

26f2439cf56b5fd64aa2b22519e33aff692bb9af18a24bc3ba1f450840d7a476
SHA512

f0f74ef891ca08800b58e1e311cbe30be669ce24510c08509380392e2eaa7a3216a1ffeac61c50a5e89211efe546d6fbe368139deb8dfa26e9bc54473c9783f3
SSDEEP

12288:SRyk2lzMdfiZRMGs+S2AjS8ocJxmH5I0I:myk2lzGiQMc98ZIh

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/996-16-0x0000000000400000-0x0000000000595000-memory.dmp	modiloader_stage2
behavioral2/memory/5028-17-0x0000000000400000-0x0000000000595000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

view.exe

pid process

996 view.exe
Drops file in System32 directory 2 IoCs

Processes:

view.exe

description ioc process

File created C:\Windows\SysWOW64\_view.exe view.exe
File opened for modification C:\Windows\SysWOW64\_view.exe view.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

view.exe

description pid process target process

PID 996 set thread context of 3664 996 view.exe calc.exe
PID 996 set thread context of 4656 996 view.exe svchost.exe

pid	process
996	view.exe

description	ioc	process
File created	C:\Windows\SysWOW64\_view.exe	view.exe
File opened for modification	C:\Windows\SysWOW64\_view.exe	view.exe

description	pid	process	target process
PID 996 set thread context of 3664	996	view.exe	calc.exe
PID 996 set thread context of 4656	996	view.exe	svchost.exe

Drops file in Program Files directory 3 IoCs

Processes:

13903a7e289cc092e67b748dfea5389c.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\view.exe	13903a7e289cc092e67b748dfea5389c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\view.exe	13903a7e289cc092e67b748dfea5389c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	13903a7e289cc092e67b748dfea5389c.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4008 3664 WerFault.exe calc.exe
2996 4656 WerFault.exe svchost.exe

pid	pid_target	process	target process
4008	3664	WerFault.exe	calc.exe
2996	4656	WerFault.exe	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

13903a7e289cc092e67b748dfea5389c.exeview.exe

description	pid	process	target process
PID 5028 wrote to memory of 996	5028	13903a7e289cc092e67b748dfea5389c.exe	view.exe
PID 5028 wrote to memory of 996	5028	13903a7e289cc092e67b748dfea5389c.exe	view.exe
PID 5028 wrote to memory of 996	5028	13903a7e289cc092e67b748dfea5389c.exe	view.exe
PID 996 wrote to memory of 3664	996	view.exe	calc.exe
PID 996 wrote to memory of 3664	996	view.exe	calc.exe
PID 996 wrote to memory of 3664	996	view.exe	calc.exe
PID 996 wrote to memory of 3664	996	view.exe	calc.exe
PID 996 wrote to memory of 3664	996	view.exe	calc.exe
PID 996 wrote to memory of 4656	996	view.exe	svchost.exe
PID 996 wrote to memory of 4656	996	view.exe	svchost.exe
PID 996 wrote to memory of 4656	996	view.exe	svchost.exe
PID 996 wrote to memory of 4656	996	view.exe	svchost.exe
PID 996 wrote to memory of 4656	996	view.exe	svchost.exe
PID 5028 wrote to memory of 3492	5028	13903a7e289cc092e67b748dfea5389c.exe	cmd.exe
PID 5028 wrote to memory of 3492	5028	13903a7e289cc092e67b748dfea5389c.exe	cmd.exe
PID 5028 wrote to memory of 3492	5028	13903a7e289cc092e67b748dfea5389c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\13903a7e289cc092e67b748dfea5389c.exe
"C:\Users\Admin\AppData\Local\Temp\13903a7e289cc092e67b748dfea5389c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5028

C:\Program Files\Common Files\Microsoft Shared\MSINFO\view.exe
"C:\Program Files\Common Files\Microsoft Shared\MSINFO\view.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\calc.exe
"C:\Windows\system32\calc.exe"
3⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 12
4⤵
- Program crash
PID:4008

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
3⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 12
4⤵
- Program crash
PID:2996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
2⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4656 -ip 4656
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3664 -ip 3664
1⤵
PID:4484

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat
Filesize
184B

MD5
24c97ebb99b9e272f65481a127d73783

SHA1
087e314e75c92518edb945240b7a184e72dbd0bf

SHA256
311e13ef70e17292a3483d18799338851bd62ffe27856a2b2b65eff5d57c4db9

SHA512
fa7c7e970bb717f22d7c5a75fc1590877bc12eab1a449906fec77899a3994c92df171b253b276ad02a1825e4f7737f8f797ee372d13e3ef7f53e9fd1b128b809

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\view.exe
Filesize
489KB

MD5
13903a7e289cc092e67b748dfea5389c

SHA1
5c4c944e6bc42212165379ce8fa707672a5be10d

SHA256
26f2439cf56b5fd64aa2b22519e33aff692bb9af18a24bc3ba1f450840d7a476

SHA512
f0f74ef891ca08800b58e1e311cbe30be669ce24510c08509380392e2eaa7a3216a1ffeac61c50a5e89211efe546d6fbe368139deb8dfa26e9bc54473c9783f3

Download Submit
memory/996-10-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/996-16-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download
memory/3664-11-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download
memory/4656-13-0x0000000000800000-0x0000000000995000-memory.dmp

Filesize
1.6MB

Download
memory/5028-0-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download
memory/5028-1-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/5028-2-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/5028-17-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads