MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6878003c470e531787cd70fc0785bb01a5c64d6a39f0efec5aabc5ac3f5f889. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6878003c470e531787cd70fc0785bb01a5c64d6a39f0efec5aabc5ac3f5f889
SHA3-384 hash: 73a937859187ad9781285e8e6e4102546530e3803ad1bfbefc11fa0850801626e26d3eb77cb2cb39856159c1a2205db0
SHA1 hash: 375d5afb45445f7fcc0323d9e6b6f89f5ac64e10
MD5 hash: c850d062904edc26c843db80585c64fd
humanhash: montana-mobile-east-solar
File name:Image00110ewa_Signed_.exe
Download: download sample
Signature ModiLoader
Create hunting rule
File size:1'295'040 bytes
First seen:2020-11-05 09:31:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash eb7f24d623823df7a34ad95dfb8bfd95 (15 x ModiLoader, 1 x AveMariaRAT, 1 x Loki)
ssdeep 24576:m0S5Bo6taFaaRKDZAI89d6yzEJR4KpQSMjVHfAL:mpjExRbzEJuKpRMjw
Threatray 606 similar samples on MalwareBazaar
TLSH 05555B72F640D431E43219755F2AC6FCA53EBD602D24940A7AE9EF1C2E362D3A937247
Reporter abuse_ch
Tags:exe ModiLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RDPWrap
Create hunting rule
Link:
https://www.capesandbox.com/analysis/83155/
Detection(s):
SecuriteInfo.com.Fareit-FZO82C53D0CF1F4.16975.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% directory
Creating a process from a recently created file
Reading critical registry keys
Deleting a recently created file
Creating a file in the %temp% directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla AveMaria ModiLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/521176
Signature
Allocates memory in foreign processes
Contains functionality to hide user accounts
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops PE files to the user root directory
Hides that the sample has been downloaded from the Internet (zone.identifier)
Increases the number of concurrent connection per server for Internet Explorer
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Fodhelper UAC Bypass
Tries to harvest and steal browser information (history, passwords, etc)
Uses cmd line tools excessively to alter registry or file data
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AveMaria stealer
Yara detected ModiLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 309689 Sample: Image00110ewa_Signed_.exe Startdate: 05/11/2020 Architecture: WINDOWS Score: 100 78 cdn.discordapp.com 2->78 102 Multi AV Scanner detection for domain / URL 2->102 104 Malicious sample detected (through community Yara rule) 2->104 106 Multi AV Scanner detection for submitted file 2->106 108 7 other signatures 2->108 11 Image00110ewa_Signed_.exe 1 16 2->11         started        16 Ncvmdrv.exe 13 2->16         started        18 Ncvmdrv.exe 13 2->18         started        signatures3 process4 dnsIp5 84 cdn.discordapp.com 162.159.130.233, 443, 49721, 49732 CLOUDFLARENETUS United States 11->84 76 C:\Users\user\AppData\Local\...76cvmdrv.exe, PE32 11->76 dropped 116 Creates multiple autostart registry keys 11->116 118 Writes to foreign memory regions 11->118 120 Allocates memory in foreign processes 11->120 20 ieinstal.exe 3 30 11->20         started        25 notepad.exe 4 11->25         started        86 162.159.135.233, 443, 49738, 49750 CLOUDFLARENETUS United States 16->86 122 Multi AV Scanner detection for dropped file 16->122 124 Creates a thread in another existing process (thread injection) 16->124 126 Injects a PE file into a foreign processes 16->126 27 ieinstal.exe 16->27         started        29 ieinstal.exe 18->29         started        file6 signatures7 process8 dnsIp9 80 xxxxza.dynamic-dns.net 185.140.53.163, 49731, 5893 DAVID_CRAIGGG Sweden 20->80 82 cdn.discordapp.com 20->82 66 C:\Users\user\AppData\Roaming\.dewdacEe.exe, PE32 20->66 dropped 68 C:\Users\user\...\Oqripzo_Signed_[1].exe, PE32 20->68 dropped 70 C:\Users\Public\Ra0zezi_Signed_.exe, PE32 20->70 dropped 72 C:\Users\Public\Oqripzo_Signed_.exe, PE32 20->72 dropped 110 Tries to harvest and steal browser information (history, passwords, etc) 20->110 112 Increases the number of concurrent connection per server for Internet Explorer 20->112 114 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->114 31 .dewdacEe.exe 1 16 20->31         started        36 cmd.exe 1 25->36         started        38 cmd.exe 1 25->38         started        file10 signatures11 process12 dnsIp13 88 192.168.2.1 unknown unknown 31->88 90 cdn.discordapp.com 31->90 64 C:\Users\user\AppData\Local\...\Oqridrv.exe, PE32 31->64 dropped 92 Detected unpacking (changes PE section rights) 31->92 94 Detected unpacking (overwrites its own PE header) 31->94 96 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 31->96 98 6 other signatures 31->98 40 notepad.exe 31->40         started        43 .dewdacEe.exe 31->43         started        45 conhost.exe 36->45         started        47 conhost.exe 38->47         started        file14 signatures15 process16 file17 74 C:\Users\Public74atso.bat, ASCII 40->74 dropped 49 cmd.exe 40->49         started        52 cmd.exe 40->52         started        process18 signatures19 100 Uses cmd line tools excessively to alter registry or file data 49->100 54 conhost.exe 49->54         started        56 reg.exe 49->56         started        58 reg.exe 49->58         started        60 conhost.exe 52->60         started        62 reg.exe 52->62         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6878003c470e531787cd70fc0785bb01a5c64d6a39f0efec5aabc5ac3f5f889/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-11-04 06:01:06 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=62dyaa6eodstc6d424h4a6c3wanfyzgwuopq57wfvk6fvq7v7ceq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
Similar samples:
0629278e51106220eb8727f80f4c24cfb432e6344561e8518030b19b669bcc72
ModiLoader
2cc5a802aaf99da12f98c79d28f14a2e850b9a9afc4c0f682430a425643d8cda
ModiLoader
4e420c5efeb26330ec4eb618426d859222b791798df3ae65c59fc20ef2f2889a
ModiLoader
52e8ebb47ae631081c6ac0ab78219951e8c7ac540e11b420e92d5df89ea719d7
ModiLoader
97b34cb713e879fb7cfe158a3180b73d1c71b71446368f242a0c004d0c3462dd
ModiLoader
9f5afe868a8dd23926e807303d8896b239b802a3c366e448f4c59a103540019f
ModiLoader
af84cf642737e0b62537d9a78861cc129fbc0e68a34770cb70c6ccaa3f553687
ModiLoader
b50f9caa6df41cf34a52f45f989dc38ba037fd68535f6d7015fe602c826b0c1c
ModiLoader
d30b949fc05b15b611b3fe420b6883062c5bb2b270c769540c48f703a46cbbf3
ModiLoader
e0e3ae47b7e48c3c81724d0a63f5f6f8033bb516d97c538ea52349a102a0e1b6
ModiLoader
+ 596 additional samples on MalwareBazaar
Result
Malware family:
warzonerat
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:warzonerat infostealer persistence rat trojan spyware
Link:
https://tria.ge/reports/201105-sbzhwqj5rx/
Behaviour
Modifies registry key
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
JavaScript code in executable
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
ModiLoader Second Stage
Warzone RAT Payload
ModiLoader, DBatLoader
WarzoneRat, AveMaria
Unpacked files
SH256 hash:
f6878003c470e531787cd70fc0785bb01a5c64d6a39f0efec5aabc5ac3f5f889
MD5 hash:
c850d062904edc26c843db80585c64fd
SHA1 hash:
375d5afb45445f7fcc0323d9e6b6f89f5ac64e10
Link:
https://www.unpac.me/results/cf587559-7272-46b3-8e16-a71888e720cf/
SH256 hash:
99863593700056414e4c5f9687eed84fc4c28dfbbe51f6c0d77c45323c5ac299
MD5 hash:
efa7ce62f8e3880d475e4bb16408ae40
SHA1 hash:
1ed239d211fd3786c2aabb4e2ec78f5d4d039233
Link:
https://www.unpac.me/results/cf587559-7272-46b3-8e16-a71888e720cf/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

Executable exe f6878003c470e531787cd70fc0785bb01a5c64d6a39f0efec5aabc5ac3f5f889

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/83155/

Comments