MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc
SHA3-384 hash: 37f9f638844321c88a3647fd0e6792e11b3c140387861d01e510ddf0fe2e9582451c22a28d7585141f93cc6d6ff95340
SHA1 hash: e1884c073f2a3c11decba1f914e0ca4d3dc0eb11
MD5 hash: 66a395765d579f24cf42766d37072416
humanhash: vermont-asparagus-artist-eleven
File name:Payment Order Inv.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:789'000 bytes
First seen:2020-12-22 08:19:31 UTC
Last seen:2020-12-22 09:56:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b922df5919ec1c1518550080ff5a6e4 (2 x ModiLoader, 1 x AgentTesla)
ssdeep 12288:NSru3RhTq6uJEbqoemAcBHbWFqOCqeE2F40xjEUsaG:NASAJE41e6FqOHIV/tG
Threatray 3'241 similar samples on MalwareBazaar
TLSH E2F4AEE2B2E08137C972E734CD53B37455297ED42D2D9829AAF93C3C2E3BA41B126157
Reporter abuse_ch
Tags:exe ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: WIN-JT1Q93QSGMB.rapiddns.pw
Sending IP: 148.251.191.120
From: salesexpert@mashadsadra.com
Reply-To: salesexpert@mashadsadra.com
Subject: RE: PAYMENT COPY SHIPPING COMMERCAIL INVOICE
Attachment: Payment Order Inv.zip (contains "Payment Order Inv.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
338
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment Order Inv.exe
Verdict:
Malicious activity
Analysis date:
2020-12-22 09:25:54 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/41c14a77-3539-4deb-8c9a-980f0ac60461

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/108669/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/568043
Signature
Allocates memory in foreign processes
Creates an undocumented autostart registry key
Detected FormBook malware
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Steal Google chrome login data
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses ipconfig to lookup or modify the Windows network settings
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 333094 Sample: Payment  Order Inv.exe Startdate: 22/12/2020 Architecture: WINDOWS Score: 100 69 Malicious sample detected (through community Yara rule) 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 Sigma detected: Steal Google chrome login data 2->73 75 6 other signatures 2->75 10 Payment  Order Inv.exe 1 16 2->10         started        process3 dnsIp4 55 cdn.discordapp.com 162.159.134.233, 443, 49736 CLOUDFLARENETUS United States 10->55 57 discord.com 162.159.136.232, 443, 49735 CLOUDFLARENETUS United States 10->57 49 C:\Users\user\AppData\Local\...behaviorgraphljtdvst.exe, PE32 10->49 dropped 103 Writes to foreign memory regions 10->103 105 Allocates memory in foreign processes 10->105 107 Injects a PE file into a foreign processes 10->107 15 ieinstal.exe 10->15         started        file5 signatures6 process7 signatures8 109 Modifies the context of a thread in another process (thread injection) 15->109 111 Maps a DLL or memory area into another process 15->111 113 Sample uses process hollowing technique 15->113 115 Queues an APC in another process (thread injection) 15->115 18 explorer.exe 4 15->18 injected process9 dnsIp10 51 www.lakecharlesloan.com 199.59.242.153, 49772, 49773, 49774 BODIS-NJUS United States 18->51 53 www.plantbasedtransporter.com 18->53 85 System process connects to network (likely due to code injection or exploit) 18->85 22 netsh.exe 1 18 18->22         started        26 Gljtdvst.exe 14 18->26         started        29 Gljtdvst.exe 13 18->29         started        31 2 other processes 18->31 signatures11 process12 dnsIp13 45 C:\Users\user\AppData\...\832logrv.ini, data 22->45 dropped 47 C:\Users\user\AppData\...\832logri.ini, data 22->47 dropped 87 Detected FormBook malware 22->87 89 Creates an undocumented autostart registry key 22->89 91 Tries to steal Mail credentials (via file access) 22->91 101 3 other signatures 22->101 33 cmd.exe 2 22->33         started        59 162.159.129.233, 443, 49751, 49761 CLOUDFLARENETUS United States 26->59 61 162.159.138.232, 443, 49750, 49759 CLOUDFLARENETUS United States 26->61 67 2 other IPs or domains 26->67 93 Writes to foreign memory regions 26->93 95 Allocates memory in foreign processes 26->95 97 Injects a PE file into a foreign processes 26->97 37 ieinstal.exe 26->37         started        63 discord.com 29->63 65 cdn.discordapp.com 29->65 39 ieinstal.exe 29->39         started        99 Tries to detect virtualization through RDTSC time measurements 31->99 file14 signatures15 process16 file17 43 C:\Users\user\AppData\Local\Temp\DB1, SQLite 33->43 dropped 77 Tries to harvest and steal browser information (history, passwords, etc) 33->77 41 conhost.exe 33->41         started        79 Modifies the context of a thread in another process (thread injection) 37->79 81 Maps a DLL or memory area into another process 37->81 83 Sample uses process hollowing technique 37->83 signatures18 process19
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc/
Threat name:
Win32.Trojan.NetWired
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 08:20:07 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lnm6bductfgnpdpyqvwf27h5jmyl5fd2t5zstly2cpkhmuvrrh6a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
02c69531b427dfcd3727b5cea0b1bd11463901daa643165d606feb92e138587c
ModiLoader
091f6c53a4f73bdac192e08bda0459f5e8af953a3c2b5cdee175677301a8cef5
ModiLoader
1b4249b0b590b4166f62a4e9fff3dfccc4d46cca9173d9c669311738fd98d2dd
ModiLoader
82f4ebd30b18743d8cc409de5931a978434755705af9bbfa3c6d8d0b34d30a6b
ModiLoader
89bf15eae14f60d6acc308cead31f09459947626b9839bbbddbf76f00821fe3b
ModiLoader
9107a8988792e1ec695a1d662a6b0f7668a6fbfb6352897c1f5bfe85addf2994
ModiLoader
b19d067a87767c377a60981192e5edb9256ce11f7d663cdcae2af3d8d0c0c382
ModiLoader
c6232f818d7c848dee9a6a653df75e0174e38362ff2e5f6040c5e7418af5f219
ModiLoader
ded4435057919aa79f8453db4172ffd89198323fa247e70daa418a7a21136df2
ModiLoader
e4974ddc809773cd725cfc7070ad545ddf4aa1fc211eb77a1eaae7b7fc1a019c
ModiLoader
+ 3'231 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:modiloader persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201222-sdnwbnfm6s/
Behaviour
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Adds Run key to start application
Adds policy Run key to start application
Formbook Payload
ModiLoader First Stage
Formbook
ModiLoader, DBatLoader
Malware Config
C2 Extraction:
http://www.plantbasedtransporter.com/m98/
Unpacked files
SH256 hash:
5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc
MD5 hash:
66a395765d579f24cf42766d37072416
SHA1 hash:
e1884c073f2a3c11decba1f914e0ca4d3dc0eb11
Link:
https://www.unpac.me/results/9fb6bad5-1ee5-43dd-bb83-caaea3582f70/
SH256 hash:
5f8f2d458a1fa5d9fd75e6886504ad906d582d452e156f4d4934f8a869642602
MD5 hash:
784ecfbb12e91898d5e68d15766fcb22
SHA1 hash:
a34727b499065be64a56139b313810841724e1ec
Detections:
win_dbatloader_g0
Create hunting rule
Link:
https://www.unpac.me/results/9fb6bad5-1ee5-43dd-bb83-caaea3582f70/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_dbatloader_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Description:targets loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip af3938c7452142db8f2fbb5d5797ac0d83febe07469e8733265105f9eb108442

ModiLoader

Executable exe 5b59e08e82994cd78df8856c5d7cfd4b30be947a9f7329af1a13d47652b189fc

(this sample)

  
Dropped by
MD5 74c5cd7b845659c63fd90ca9613f2ad2
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 af3938c7452142db8f2fbb5d5797ac0d83febe07469e8733265105f9eb108442
Cape
Cape
https://www.capesandbox.com/analysis/108669/

Comments