MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ce29350390228c4f8cf474b079fc0e786b364cf5c0c8994b7ad1137c185be3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ce29350390228c4f8cf474b079fc0e786b364cf5c0c8994b7ad1137c185be3b
SHA3-384 hash: a57626ff0be05f9515f244f4dae3ab57f2ba1b2a42ffb4890bc6b922ef7b7cd2f727c0862ecc53059ef68987d2d86dff
SHA1 hash: 852a1c04b76a3308a727bb0213b7d33f71d9f66c
MD5 hash: 51bbe3ed781e4837bb1e78675f490cf9
humanhash: nevada-mars-stairway-yellow
File name:Doc Order.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:864'256 bytes
First seen:2020-10-20 08:14:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9d99d2b7dc0b1c0b642d9d88933e0dd9 (8 x ModiLoader, 1 x RemcosRAT)
ssdeep 12288:Gg6qVpf8BGuCG43fxR8bUQFqSjRJsK/Alo4fMCGOLou:GgZoBGuX44pbLmloDpw
Threatray 1'128 similar samples on MalwareBazaar
TLSH 1C059E63B2918837C1731A79DD0BAB685D39FE007D20A4463BFC2D4C9F79641787A2A7
Reporter abuse_ch
Tags:exe ModiLoader


Avatar
abuse_ch
Malspam distributing ModiLoader:

HELO: rdns0.deresa.xyz
Sending IP: 104.131.179.64
From: Emil.stefanek <sales@buhlergroup.com>
Subject: FW: revised document order
Attachment: Doc Order.zip (contains "Doc Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/73308/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Setting a global event handler for the keyboard
Connection attempt to an infection source
Unauthorized injection to a system process
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/497263
Signature
Allocates memory in foreign processes
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Detected Remcos RAT
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 300807 Sample: Doc Order.exe Startdate: 20/10/2020 Architecture: WINDOWS Score: 100 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Detected Remcos RAT 2->52 54 7 other signatures 2->54 8 Doc Order.exe 1 15 2->8         started        13 Josfdrv.exe 13 2->13         started        15 Josfdrv.exe 13 2->15         started        process3 dnsIp4 38 cdn.discordapp.com 162.159.133.233, 443, 49721, 49753 CLOUDFLARENETUS United States 8->38 40 discord.com 162.159.136.232, 443, 49720, 49747 CLOUDFLARENETUS United States 8->40 34 C:\Users\user\AppData\Local\...\Josfdrv.exe, PE32 8->34 dropped 56 Writes to foreign memory regions 8->56 58 Allocates memory in foreign processes 8->58 60 Creates a thread in another existing process (thread injection) 8->60 17 ieinstal.exe 2 3 8->17         started        20 notepad.exe 4 8->20         started        42 162.159.129.233, 443, 49748 CLOUDFLARENETUS United States 13->42 62 Multi AV Scanner detection for dropped file 13->62 64 Injects a PE file into a foreign processes 13->64 22 ieinstal.exe 13->22         started        44 162.159.137.232, 443, 49752 CLOUDFLARENETUS United States 15->44 46 192.168.2.1 unknown unknown 15->46 24 ieinstal.exe 15->24         started        file5 signatures6 process7 dnsIp8 36 blazeblaze.ddns.net 52.185.130.43, 10008 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 17->36 26 cmd.exe 1 20->26         started        28 cmd.exe 1 20->28         started        process9 process10 30 conhost.exe 26->30         started        32 conhost.exe 28->32         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ce29350390228c4f8cf474b079fc0e786b364cf5c0c8994b7ad1137c185be3b/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 07:04:48 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ntrjgubzaiumj6gpi5fqph6a46dlgzgplqgitffxvuitpqmfxy5q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
31963673bc347fe4a6c795c90a0bcbddbf701158feab1b831bce2b082aeacf7f
ModiLoader
46ff7f6619eda7e3b2c5b36a2d3f21b154749d31ae2695c4d23c992361ce1f58
ModiLoader
47d694226b7f034e868ded9f3ebc12b1afbf9bbccb791f4a98c61955f10efa19
ModiLoader
5b1f1843bbb992e3d5c635aa69d8409de4ae4d3f04cf19994d8e953e99cf451a
ModiLoader
99a8e371d2d05838012be53f7e86a675acdc9be4770eb4372779a85a574c2f1a
ModiLoader
9b60c965a1425ff01954ce6a917cb4486d5af5cb36f538233139042ea324a64e
ModiLoader
b8c6d9ced99143d34fd8829125c6ff46bc0c55569f401ec4d1354f3d0825c4c4
ModiLoader
c358b44f578fd2dedbb1899038415395ae2052c113aaa149481cde295e022bda
ModiLoader
ce30dea0b1d4fa181753600eb63c1d2f1a7de1bd848dcdbe196f6a35afef0ea9
ModiLoader
fb28260466e3ce4029f48c81b60a1ef83e755e772672a28cea1f00f51984c808
ModiLoader
+ 1'118 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:modiloader rat family:remcos
Link:
https://tria.ge/reports/201020-1712e3sqw2/
Behaviour
Modifies registry key
Modifies system certificate store
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Adds Run key to start application
ModiLoader First Stage
ModiLoader Second Stage
ModiLoader, DBatLoader
Remcos
Unpacked files
SH256 hash:
6ce29350390228c4f8cf474b079fc0e786b364cf5c0c8994b7ad1137c185be3b
MD5 hash:
51bbe3ed781e4837bb1e78675f490cf9
SHA1 hash:
852a1c04b76a3308a727bb0213b7d33f71d9f66c
Link:
https://www.unpac.me/results/d981c8bf-19d7-4eff-aa0d-1294fab6b30f/
SH256 hash:
09d882b9f2ee1b1c4e741148bff6022ad2dc954336f4a0068e74ac44b8c0da90
MD5 hash:
2d396f6b17ced0f5bbe35732b059f39a
SHA1 hash:
f99451819cad0af6dc99df27d3c59ac47c50a2ec
Link:
https://www.unpac.me/results/d981c8bf-19d7-4eff-aa0d-1294fab6b30f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/6ce29350390228c4f8cf474b079fc0e786b364cf5c0c8994b7ad1137c185be3b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:MALWARE_Win_DLAgent03
Create hunting rule
Author:ditekSHen
Description:Detects known Delphi downloader agent downloading second stage payload, notably from discord

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 2d923441fe1f5464ec8b13077e2a2f9d4f97d6a32d1c1f1bee777d388d6f8809

ModiLoader

Executable exe 6ce29350390228c4f8cf474b079fc0e786b364cf5c0c8994b7ad1137c185be3b

(this sample)

  
Dropped by
MD5 8b98817aed47bf90db7e8c2f2c04d585
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/73308/
  
Dropped by
SHA256 2d923441fe1f5464ec8b13077e2a2f9d4f97d6a32d1c1f1bee777d388d6f8809

Comments