modiloader | 277a01095a13bf08041d5a78c06f9f9ff32e77665e03cdd32c83ddc32a52fa59

Analysis

max time kernel
132s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/02/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PRODUCT.bat
Size 2.6MB
Sample240206-jmh8dsbcc4
SHA256 277a01095a13bf08041d5a78c06f9f9ff32e77665e03cdd32c83ddc32a52fa59
MD5 82934f26cfc4b72a15289fe4055faca3
SHA1 1a3d048f809a5dad4ee89670b94f42cf708b199a
SHA512 4aeab25a0867a198cf62d1f9d611db6db91ee6c625fadcfba8516731356a6b79017eaa3c98da840a48076d05494ca389b20f4c7013f41f764c95854f2c11902f
SSDEEP 24576:4pMnYCoTzMBGtRfB7M0iCIvTNzaNC5+PSCgcCPdQtJdaTrtFsAzDmThQNWmeC8qr:4p0YTTz5RRm6UCmWSiIuXhY4wV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2792-5-0x0000000003220000-0x0000000004220000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2792	pointer.com

Loads dropped DLL 2 IoCs

pid	Process
2924	WerFault.exe
2924	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	2792	WerFault.exe	35

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2124	PING.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2792	pointer.com

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1660	3044	cmd.exe	29
PID 3044 wrote to memory of 1660	3044	cmd.exe	29
PID 3044 wrote to memory of 1660	3044	cmd.exe	29
PID 3044 wrote to memory of 2980	3044	cmd.exe	30
PID 3044 wrote to memory of 2980	3044	cmd.exe	30
PID 3044 wrote to memory of 2980	3044	cmd.exe	30
PID 3044 wrote to memory of 2132	3044	cmd.exe	32
PID 3044 wrote to memory of 2132	3044	cmd.exe	32
PID 3044 wrote to memory of 2132	3044	cmd.exe	32
PID 2132 wrote to memory of 2124	2132	cmd.exe	33
PID 2132 wrote to memory of 2124	2132	cmd.exe	33
PID 2132 wrote to memory of 2124	2132	cmd.exe	33
PID 3044 wrote to memory of 2772	3044	cmd.exe	34
PID 3044 wrote to memory of 2772	3044	cmd.exe	34
PID 3044 wrote to memory of 2772	3044	cmd.exe	34
PID 2772 wrote to memory of 2792	2772	cmd.exe	35
PID 2772 wrote to memory of 2792	2772	cmd.exe	35
PID 2772 wrote to memory of 2792	2772	cmd.exe	35
PID 2772 wrote to memory of 2792	2772	cmd.exe	35
PID 3044 wrote to memory of 2768	3044	cmd.exe	36
PID 3044 wrote to memory of 2768	3044	cmd.exe	36
PID 3044 wrote to memory of 2768	3044	cmd.exe	36
PID 2792 wrote to memory of 2924	2792	pointer.com	37
PID 2792 wrote to memory of 2924	2792	pointer.com	37
PID 2792 wrote to memory of 2924	2792	pointer.com	37
PID 2792 wrote to memory of 2924	2792	pointer.com	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PRODUCT.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\cmd.exe
  cmd /c del "C:\Users\Public\pointer.com" / A / F / Q / S
  2⤵
  PID:1660
- C:\Windows\system32\certutil.exe
  certutil -decodehex "C:\Users\Admin\AppData\Local\Temp\PRODUCT.bat" "C:\Users\Public\pointer.com" 3
  2⤵
  PID:2980
- C:\Windows\system32\cmd.exe
  cmd /c PING -n 2 127.0.0.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\PING.EXE
    PING -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2124
- C:\Windows\system32\cmd.exe
  cmd /c start C:\Users\Public\pointer.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Public\pointer.com
    C:\Users\Public\pointer.com
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 732
      4⤵
      Loads dropped DLL
      Program crash
      PID:2924
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 0
  2⤵
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pointer.com

Path C:\Users\Public\pointer.com
Size 1.9MB
SHA256 1d53d90687c4f61739b3d186d0c296a3fe47b0da1f599ac8115e11194ad49b30
MD5 9d00a95be6b82ab307043a988595487b
SHA1 71aea046547dc1f55977cfa5cf969529004e4714
SHA512 8aee0b7fb748f19af30f73021b23b09b4a3281eae1b4d6a99c20fbd47e38e66f4b66937fd54eee6da7986f87519fad6635985b86b0657d128a738e4106654950
SSDEEP 49152:Dy6SW7XUFcn9rcFw/uRHtojhvQIBXFlxvAr:D8W7EFcBURHtojhvQIBXFlx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2792-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/2792-4-0x0000000003220000-0x0000000004220000-memory.dmp

Download

memory/2792-5-0x0000000003220000-0x0000000004220000-memory.dmp

Download

memory/2792-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/2792-8-0x0000000000400000-0x00000000005E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads