modiloader | 985dda76570c9efdd692eca4a7bef55c99cbcac5ae7683360c115ea5529ebaa5

General

Target

PO3488-0337.bat
Size

3.9MB
MD5

9a987344afb7334bd5fceeae97055408
SHA1

946845c94b61847bf8cefeff153eaa4f9095f55f
SHA256

985dda76570c9efdd692eca4a7bef55c99cbcac5ae7683360c115ea5529ebaa5
SHA512

d212f4fc0db74da7754ef4830128db8bfb8239184a6cab2609bd251e0df4fc972d364a2dda7b0f790ec09930c200c6c96b0decd3203edd32aafdc492b78e3f17
SSDEEP

49152:XgJ9GvW/Z22bISDp6JXl62tBW7Abb/1XaN+Nkn:i

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2116-34-0x0000000002E30000-0x0000000003E30000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exeYano.comalpha.exealpha.exe

pid process

2844 alpha.exe
2928 alpha.exe
2580 kn.exe
2628 alpha.exe
2512 kn.exe
2116 Yano.com
2472 alpha.exe
2408 alpha.exe
Loads dropped DLL 7 IoCs

Processes:

cmd.exealpha.exealpha.exeWerFault.exe

pid process

2036 cmd.exe
2036 cmd.exe
2928 alpha.exe
2036 cmd.exe
2628 alpha.exe
2784 WerFault.exe
2784 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2784 2116 WerFault.exe Yano.com
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

Yano.com

pid process

2116 Yano.com

pid	process
2844	alpha.exe
2928	alpha.exe
2580	kn.exe
2628	alpha.exe
2512	kn.exe
2116	Yano.com
2472	alpha.exe
2408	alpha.exe

pid	process
2036	cmd.exe
2036	cmd.exe
2928	alpha.exe
2036	cmd.exe
2628	alpha.exe
2784	WerFault.exe
2784	WerFault.exe

pid	pid_target	process	target process
2784	2116	WerFault.exe	Yano.com

pid	process
2116	Yano.com

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exeYano.com

description	pid	process	target process
PID 2036 wrote to memory of 2160	2036	cmd.exe	extrac32.exe
PID 2036 wrote to memory of 2160	2036	cmd.exe	extrac32.exe
PID 2036 wrote to memory of 2160	2036	cmd.exe	extrac32.exe
PID 2036 wrote to memory of 2844	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2844	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2844	2036	cmd.exe	alpha.exe
PID 2844 wrote to memory of 2120	2844	alpha.exe	extrac32.exe
PID 2844 wrote to memory of 2120	2844	alpha.exe	extrac32.exe
PID 2844 wrote to memory of 2120	2844	alpha.exe	extrac32.exe
PID 2036 wrote to memory of 2928	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2928	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2928	2036	cmd.exe	alpha.exe
PID 2928 wrote to memory of 2580	2928	alpha.exe	kn.exe
PID 2928 wrote to memory of 2580	2928	alpha.exe	kn.exe
PID 2928 wrote to memory of 2580	2928	alpha.exe	kn.exe
PID 2036 wrote to memory of 2628	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2628	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2628	2036	cmd.exe	alpha.exe
PID 2628 wrote to memory of 2512	2628	alpha.exe	kn.exe
PID 2628 wrote to memory of 2512	2628	alpha.exe	kn.exe
PID 2628 wrote to memory of 2512	2628	alpha.exe	kn.exe
PID 2036 wrote to memory of 2116	2036	cmd.exe	Yano.com
PID 2036 wrote to memory of 2116	2036	cmd.exe	Yano.com
PID 2036 wrote to memory of 2116	2036	cmd.exe	Yano.com
PID 2036 wrote to memory of 2116	2036	cmd.exe	Yano.com
PID 2036 wrote to memory of 2472	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2472	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2472	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2408	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2408	2036	cmd.exe	alpha.exe
PID 2036 wrote to memory of 2408	2036	cmd.exe	alpha.exe
PID 2116 wrote to memory of 2784	2116	Yano.com	WerFault.exe
PID 2116 wrote to memory of 2784	2116	Yano.com	WerFault.exe
PID 2116 wrote to memory of 2784	2116	Yano.com	WerFault.exe
PID 2116 wrote to memory of 2784	2116	Yano.com	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PO3488-0337.bat"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:2160

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:2120

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PO3488-0337.bat" "C:\\Users\\Public\\Yano.txt" 9
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PO3488-0337.bat" "C:\\Users\\Public\\Yano.txt" 9
3⤵
- Executes dropped EXE
PID:2580

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12
3⤵
- Executes dropped EXE
PID:2512

C:\Users\Public\Libraries\Yano.com
C:\Users\Public\Libraries\Yano.com
2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 724
3⤵
- Loads dropped DLL
- Program crash
PID:2784

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\Yano.txt" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2472

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\Yano.com

Filesize
1.4MB

MD5
a77fc511951e177b19df5e7604d39006

SHA1
cfa9a6bf1f4cd3f652575c56821702e75e9ac0b4

SHA256
9537982a9501f4dd4474d080c147a5afa3f125f6617811486c6341cdba1aa2da

SHA512
1af66d8c0996fb61f8842b7a9616e1c84a646f2eefc776dcf4a36df0752efbd777bf7f35b4143c94991e6fed6f074a6f93be189a3506e4811c830ab40e450b39

Download Submit
C:\Users\Public\Yano.txt

Filesize
2.8MB

MD5
870803b239f8eafe8c904002d071242a

SHA1
3636a93964cf42a9d9adbeb8fc91e73ddc9bea1f

SHA256
f7cdbc8097cfc5ad70a9d5337b4bf699b9980b64d73d17cdd419ca8bb560f8ac

SHA512
c065f4536ef7a932c6868689bd352a5cc6ed85f12ee5af540a7cfb537ae27d3e989c4a5d2a88521e66eb0efc385d8c24dde44befb91c224a4d259ca2ef888e6d

Download Submit
\Users\Public\alpha.exe

Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
\Users\Public\kn.exe

Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
memory/2116-30-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2116-33-0x0000000002E30000-0x0000000003E30000-memory.dmp

Filesize
16.0MB

Download
memory/2116-34-0x0000000002E30000-0x0000000003E30000-memory.dmp

Filesize
16.0MB

Download
memory/2116-36-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2116-37-0x0000000000400000-0x0000000000573000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads