modiloader | 2ffd794617caa37c56661fa29be97f34a50f7a49f76e4caa3570b6f2cadd7b34

General

Target

Nainlvkuhdtqpx.exe
Size

700KB
MD5

547abdfd3ecdbbc533c608b4a3168b99
SHA1

6b5b996871c2da3494cfcdc0d352acf35ad486c7
SHA256

2ffd794617caa37c56661fa29be97f34a50f7a49f76e4caa3570b6f2cadd7b34
SHA512

aee32e21489ed4b3c1cb6594996a34aa52242897a7fb2de6d3ee4a23cafb4c0bc7506f1561247d2afe5219cd0c6fec9e4cbe9935d2887fd4ea9f9acae1f2af27
SSDEEP

12288:bgBB6jXPwPtg1b0RYoaN8ntpKzHVKnqAFchi8oyn7nBad:byESSV4YCQzHMqSATB

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2016-55-0x00000000002D0000-0x00000000002FD000-memory.dmp	modiloader_stage2
behavioral1/memory/1160-59-0x0000000000290000-0x00000000002BD000-memory.dmp	modiloader_stage2
behavioral1/memory/1496-67-0x0000000000280000-0x00000000002AD000-memory.dmp	modiloader_stage2
behavioral1/memory/1592-71-0x00000000005C0000-0x00000000005ED000-memory.dmp	modiloader_stage2
behavioral1/memory/1148-75-0x0000000000310000-0x000000000033D000-memory.dmp	modiloader_stage2
behavioral1/memory/1556-79-0x0000000000540000-0x000000000056D000-memory.dmp	modiloader_stage2
behavioral1/memory/1932-83-0x00000000004C0000-0x00000000004ED000-memory.dmp	modiloader_stage2
behavioral1/memory/1648-87-0x0000000000270000-0x000000000029D000-memory.dmp	modiloader_stage2
behavioral1/memory/1104-95-0x00000000003B0000-0x00000000003DD000-memory.dmp	modiloader_stage2
behavioral1/memory/940-99-0x0000000000650000-0x000000000067D000-memory.dmp	modiloader_stage2

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

Nainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exe

pid	process
2016	Nainlvkuhdtqpx.exe
1160	Nainlvkuhdtqpx.exe
764	Nainlvkuhdtqpx.exe
1496	Nainlvkuhdtqpx.exe
1592	Nainlvkuhdtqpx.exe
1148	Nainlvkuhdtqpx.exe
1556	Nainlvkuhdtqpx.exe
1932	Nainlvkuhdtqpx.exe
1648	Nainlvkuhdtqpx.exe
748	Nainlvkuhdtqpx.exe
1104	Nainlvkuhdtqpx.exe
940	Nainlvkuhdtqpx.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

Nainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exeNainlvkuhdtqpx.exe

description	pid	process	target process
PID 2016 wrote to memory of 1160	2016	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 2016 wrote to memory of 1160	2016	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 2016 wrote to memory of 1160	2016	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 2016 wrote to memory of 1160	2016	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1160 wrote to memory of 764	1160	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1160 wrote to memory of 764	1160	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1160 wrote to memory of 764	1160	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1160 wrote to memory of 764	1160	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 764 wrote to memory of 1496	764	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 764 wrote to memory of 1496	764	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 764 wrote to memory of 1496	764	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 764 wrote to memory of 1496	764	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1496 wrote to memory of 1592	1496	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1496 wrote to memory of 1592	1496	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1496 wrote to memory of 1592	1496	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1496 wrote to memory of 1592	1496	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1592 wrote to memory of 1148	1592	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1592 wrote to memory of 1148	1592	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1592 wrote to memory of 1148	1592	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1592 wrote to memory of 1148	1592	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1148 wrote to memory of 1556	1148	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1148 wrote to memory of 1556	1148	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1148 wrote to memory of 1556	1148	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1148 wrote to memory of 1556	1148	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1556 wrote to memory of 1932	1556	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1556 wrote to memory of 1932	1556	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1556 wrote to memory of 1932	1556	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1556 wrote to memory of 1932	1556	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1932 wrote to memory of 1648	1932	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1932 wrote to memory of 1648	1932	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1932 wrote to memory of 1648	1932	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1932 wrote to memory of 1648	1932	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1648 wrote to memory of 748	1648	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1648 wrote to memory of 748	1648	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1648 wrote to memory of 748	1648	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1648 wrote to memory of 748	1648	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 748 wrote to memory of 1104	748	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 748 wrote to memory of 1104	748	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 748 wrote to memory of 1104	748	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 748 wrote to memory of 1104	748	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1104 wrote to memory of 940	1104	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1104 wrote to memory of 940	1104	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1104 wrote to memory of 940	1104	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 1104 wrote to memory of 940	1104	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 940 wrote to memory of 1204	940	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 940 wrote to memory of 1204	940	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 940 wrote to memory of 1204	940	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe
PID 940 wrote to memory of 1204	940	Nainlvkuhdtqpx.exe	Nainlvkuhdtqpx.exe

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
"C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:764

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1148

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1556

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
C:\Users\Admin\AppData\Local\Temp\Nainlvkuhdtqpx.exe
13⤵
PID:1204

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-89-0x0000000000000000-mapping.dmp

Download
memory/764-61-0x0000000000000000-mapping.dmp

Download
memory/940-99-0x0000000000650000-0x000000000067D000-memory.dmp

Filesize
180KB

Download
memory/940-97-0x0000000000000000-mapping.dmp

Download
memory/1104-95-0x00000000003B0000-0x00000000003DD000-memory.dmp

Filesize
180KB

Download
memory/1104-93-0x0000000000000000-mapping.dmp

Download
memory/1148-73-0x0000000000000000-mapping.dmp

Download
memory/1148-75-0x0000000000310000-0x000000000033D000-memory.dmp

Filesize
180KB

Download
memory/1160-57-0x0000000000000000-mapping.dmp

Download
memory/1160-59-0x0000000000290000-0x00000000002BD000-memory.dmp

Filesize
180KB

Download
memory/1204-101-0x0000000000000000-mapping.dmp

Download
memory/1496-65-0x0000000000000000-mapping.dmp

Download
memory/1496-67-0x0000000000280000-0x00000000002AD000-memory.dmp

Filesize
180KB

Download
memory/1556-79-0x0000000000540000-0x000000000056D000-memory.dmp

Filesize
180KB

Download
memory/1556-77-0x0000000000000000-mapping.dmp

Download
memory/1592-71-0x00000000005C0000-0x00000000005ED000-memory.dmp

Filesize
180KB

Download
memory/1592-69-0x0000000000000000-mapping.dmp

Download
memory/1648-85-0x0000000000000000-mapping.dmp

Download
memory/1648-87-0x0000000000270000-0x000000000029D000-memory.dmp

Filesize
180KB

Download
memory/1932-81-0x0000000000000000-mapping.dmp

Download
memory/1932-83-0x00000000004C0000-0x00000000004ED000-memory.dmp

Filesize
180KB

Download
memory/2016-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2016-55-0x00000000002D0000-0x00000000002FD000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads