modiloader | 4435c0ce872e32ab8d062410bce85d1c0b1c0e49a87f9e67b894f8534be3d076

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CORRECTION_FORM_INFO.bat
Size 21.0MB
Sample240221-dstnesad7y
SHA256 f3f6e3f357652d2d7a9f393cb658bcbee22655cf4b2d82f1dbce8754593597ca
MD5 a43d37dddd5508c17cd21d4fb147e0e4
SHA1 c09653847d7982e768c194d7f87aa7a5dc117798
SHA512 141e8fb380d8300562eb0f06db48237032ee505dbeeeef53e37a0e408d69d1723d002e2461db4b66cddb96ce63dd6c2172be23f41b91ef32dd6c2d0ce3e2d43a
SSDEEP 24576:RLM2LFX2P6Qv1hhxfAswo1eoKHMX+mIi8g1CLbGBi3oucj+9OtOT+a0sloBJCpDB:RYQSv1fxfAsJ1eoVuSDW0YXEA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2804-5-0x00000000088A0000-0x00000000098A0000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2804	pointer.com

Loads dropped DLL 2 IoCs

pid	Process
2612	WerFault.exe
2612	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	2804	WerFault.exe	32

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2728	PING.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2804	pointer.com

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2084	2176	cmd.exe	29
PID 2176 wrote to memory of 2084	2176	cmd.exe	29
PID 2176 wrote to memory of 2084	2176	cmd.exe	29
PID 2084 wrote to memory of 2676	2084	cmd.exe	30
PID 2084 wrote to memory of 2676	2084	cmd.exe	30
PID 2084 wrote to memory of 2676	2084	cmd.exe	30
PID 2176 wrote to memory of 2728	2176	cmd.exe	31
PID 2176 wrote to memory of 2728	2176	cmd.exe	31
PID 2176 wrote to memory of 2728	2176	cmd.exe	31
PID 2176 wrote to memory of 2804	2176	cmd.exe	32
PID 2176 wrote to memory of 2804	2176	cmd.exe	32
PID 2176 wrote to memory of 2804	2176	cmd.exe	32
PID 2176 wrote to memory of 2804	2176	cmd.exe	32
PID 2804 wrote to memory of 2612	2804	pointer.com	33
PID 2804 wrote to memory of 2612	2804	pointer.com	33
PID 2804 wrote to memory of 2612	2804	pointer.com	33
PID 2804 wrote to memory of 2612	2804	pointer.com	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CORRECTION_FORM_INFO.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\cmd.exe
  cmd /c certutil -decodehex "C:\Users\Admin\AppData\Local\Temp\CORRECTION_FORM_INFO.bat" "C:\Users\Public\pointer.com" 3
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\system32\certutil.exe
    certutil -decodehex "C:\Users\Admin\AppData\Local\Temp\CORRECTION_FORM_INFO.bat" "C:\Users\Public\pointer.com" 3
    3⤵
    PID:2676
- C:\Windows\system32\PING.EXE
  PING -n 3 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:2728
- C:\Users\Public\pointer.com
  C:\Users\Public\pointer.com
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 760
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pointer.com

Path C:\Users\Public\pointer.com
Size 11.1MB
SHA256 bb3653ab56fa300be401b32fc2dcff0c3395eb55337faac07587a01dc6abc216
MD5 b2f4ea53aa5d9bac6d3f50f9efd9efe9
SHA1 a9e2aa21ae3e3dba843b2da453ef4235a001df50
SHA512 6793a899477fed828ab7c002b5f6b42df2039bd53d2e193eb486a632d6deec6338fc8cb607d3eb11982ee906312a630cd95de97de8b4915c7c8011ef6e2d1a0a
SSDEEP 24576:kH+bZn4eJDePreMta+dBZPGBAvPZsRDl4D0:kH7eJiPrVBZPGBJO
MD5 SHA1 SHA512 SSDEEP

Submit Download

pointer.com

Path C:\Users\Public\pointer.com
Size 9.8MB
SHA256 68e6b0573f0696aee36e0806c16e824ce54d8f366b104a3bd4a1f7711fe8363b
MD5 fc42b17173cb8eedd2345dfaf233038a
SHA1 6723f6cee94456a2f4c6676f3ce5783e1ecbbe25
SHA512 1d101b8084e93afde9b451560ba98a8670440ac97eb1f72a7b3c0656a076b4d57e72689975932a41f5bcfa2713eab69b593f0ab3b724ffc81ed3137774343b71
SSDEEP 24576:kH+bZn4eJDePreMta+dBZPGBAvPZsRDl4D0:kH7eJiPrVBZPGBJO
MD5 SHA1 SHA512 SSDEEP

Submit Download

pointer.com

Path \Users\Public\pointer.com
Size 12.0MB
SHA256 b7f6e5365e1ae314fa151a7f2b22fb2de93842fe479f238a7b5750260ce27cf2
MD5 41df7e9ec585347f3b7d6d64e802c1bb
SHA1 3d0e8b4f74f03fda8e68447260ce7da93c87c418
SHA512 4550379cf3d955802579705782526d1dba3ed1a9a629c6c781d9e9245a2172d3a0421d55adcb177fc9b26bd07f39805be541c9290626f80f49ba9c0d656a05e1
SSDEEP 24576:kH+bZn4eJDePreMta+dBZPGBAvPZsRDl4D0:kH7eJiPrVBZPGBJO
MD5 SHA1 SHA512 SSDEEP

Submit Download

pointer.com

Path \Users\Public\pointer.com
Size 14.3MB
SHA256 7c4a002a542ce6ea2179f900ce0cc25713acc4495cd5bd9855fc4689328f195c
MD5 98bec4558e3c36f3d7e9ce02bc127b63
SHA1 11b0b41463c95d1520d1a0836b9026dee025a062
SHA512 4fb7beb4df0a3f3d1ce331afa63c1164117b4f169ca6b5540821b3bf68e2d5bb2f40fe9b4d23b644799e42b9b138f26c402ca093cb9c830fdb56dafe18d974d5
SSDEEP 24576:kH+bZn4eJDePreMta+dBZPGBAvPZsRDl4D0:kH7eJiPrVBZPGBJO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2804-3-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2804-4-0x00000000088A0000-0x00000000098A0000-memory.dmp

Download

memory/2804-5-0x00000000088A0000-0x00000000098A0000-memory.dmp

Download

memory/2804-7-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2804-8-0x0000000000400000-0x0000000000558000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads