modiloader | 985dda76570c9efdd692eca4a7bef55c99cbcac5ae7683360c115ea5529ebaa5

General

Target

985dda76570c9efdd692eca4a7bef55c99cbcac5ae7683360c115ea5529ebaa5.bat
Size

3.9MB
MD5

9a987344afb7334bd5fceeae97055408
SHA1

946845c94b61847bf8cefeff153eaa4f9095f55f
SHA256

985dda76570c9efdd692eca4a7bef55c99cbcac5ae7683360c115ea5529ebaa5
SHA512

d212f4fc0db74da7754ef4830128db8bfb8239184a6cab2609bd251e0df4fc972d364a2dda7b0f790ec09930c200c6c96b0decd3203edd32aafdc492b78e3f17
SSDEEP

49152:XgJ9GvW/Z22bISDp6JXl62tBW7Abb/1XaN+Nkn:i

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2552-32-0x0000000002DB0000-0x0000000003DB0000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exeYano.comalpha.exealpha.exe

pid process

1260 alpha.exe
1676 alpha.exe
3036 kn.exe
2256 alpha.exe
1368 kn.exe
2552 Yano.com
2628 alpha.exe
2656 alpha.exe
Loads dropped DLL 5 IoCs

Processes:

cmd.exealpha.exeWerFault.exe

pid process

2212 cmd.exe
2212 cmd.exe
1676 alpha.exe
2680 WerFault.exe
2680 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2680 2552 WerFault.exe Yano.com
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

Yano.com

pid process

2552 Yano.com

pid	process
1260	alpha.exe
1676	alpha.exe
3036	kn.exe
2256	alpha.exe
1368	kn.exe
2552	Yano.com
2628	alpha.exe
2656	alpha.exe

pid	process
2212	cmd.exe
2212	cmd.exe
1676	alpha.exe
2680	WerFault.exe
2680	WerFault.exe

pid	pid_target	process	target process
2680	2552	WerFault.exe	Yano.com

pid	process
2552	Yano.com

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exeYano.com

description	pid	process	target process
PID 2212 wrote to memory of 1916	2212	cmd.exe	extrac32.exe
PID 2212 wrote to memory of 1916	2212	cmd.exe	extrac32.exe
PID 2212 wrote to memory of 1916	2212	cmd.exe	extrac32.exe
PID 2212 wrote to memory of 1260	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 1260	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 1260	2212	cmd.exe	alpha.exe
PID 1260 wrote to memory of 1640	1260	alpha.exe	extrac32.exe
PID 1260 wrote to memory of 1640	1260	alpha.exe	extrac32.exe
PID 1260 wrote to memory of 1640	1260	alpha.exe	extrac32.exe
PID 2212 wrote to memory of 1676	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 1676	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 1676	2212	cmd.exe	alpha.exe
PID 1676 wrote to memory of 3036	1676	alpha.exe	kn.exe
PID 1676 wrote to memory of 3036	1676	alpha.exe	kn.exe
PID 1676 wrote to memory of 3036	1676	alpha.exe	kn.exe
PID 2212 wrote to memory of 2256	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 2256	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 2256	2212	cmd.exe	alpha.exe
PID 2256 wrote to memory of 1368	2256	alpha.exe	kn.exe
PID 2256 wrote to memory of 1368	2256	alpha.exe	kn.exe
PID 2256 wrote to memory of 1368	2256	alpha.exe	kn.exe
PID 2212 wrote to memory of 2552	2212	cmd.exe	Yano.com
PID 2212 wrote to memory of 2552	2212	cmd.exe	Yano.com
PID 2212 wrote to memory of 2552	2212	cmd.exe	Yano.com
PID 2212 wrote to memory of 2552	2212	cmd.exe	Yano.com
PID 2212 wrote to memory of 2628	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 2628	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 2628	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 2656	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 2656	2212	cmd.exe	alpha.exe
PID 2212 wrote to memory of 2656	2212	cmd.exe	alpha.exe
PID 2552 wrote to memory of 2680	2552	Yano.com	WerFault.exe
PID 2552 wrote to memory of 2680	2552	Yano.com	WerFault.exe
PID 2552 wrote to memory of 2680	2552	Yano.com	WerFault.exe
PID 2552 wrote to memory of 2680	2552	Yano.com	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\985dda76570c9efdd692eca4a7bef55c99cbcac5ae7683360c115ea5529ebaa5.bat"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:1916

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:1640

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\985dda76570c9efdd692eca4a7bef55c99cbcac5ae7683360c115ea5529ebaa5.bat" "C:\\Users\\Public\\Yano.txt" 9
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\985dda76570c9efdd692eca4a7bef55c99cbcac5ae7683360c115ea5529ebaa5.bat" "C:\\Users\\Public\\Yano.txt" 9
3⤵
- Executes dropped EXE
PID:3036

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12
3⤵
- Executes dropped EXE
PID:1368

C:\Users\Public\Libraries\Yano.com
C:\Users\Public\Libraries\Yano.com
2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 728
3⤵
- Loads dropped DLL
- Program crash
PID:2680

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\Yano.txt" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2628

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\Yano.com
Filesize
1.4MB

MD5
a77fc511951e177b19df5e7604d39006

SHA1
cfa9a6bf1f4cd3f652575c56821702e75e9ac0b4

SHA256
9537982a9501f4dd4474d080c147a5afa3f125f6617811486c6341cdba1aa2da

SHA512
1af66d8c0996fb61f8842b7a9616e1c84a646f2eefc776dcf4a36df0752efbd777bf7f35b4143c94991e6fed6f074a6f93be189a3506e4811c830ab40e450b39

Download Submit
C:\Users\Public\Yano.txt
Filesize
2.8MB

MD5
870803b239f8eafe8c904002d071242a

SHA1
3636a93964cf42a9d9adbeb8fc91e73ddc9bea1f

SHA256
f7cdbc8097cfc5ad70a9d5337b4bf699b9980b64d73d17cdd419ca8bb560f8ac

SHA512
c065f4536ef7a932c6868689bd352a5cc6ed85f12ee5af540a7cfb537ae27d3e989c4a5d2a88521e66eb0efc385d8c24dde44befb91c224a4d259ca2ef888e6d

Download Submit
\Users\Public\alpha.exe
Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
\Users\Public\kn.exe
Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
memory/2552-26-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2552-31-0x0000000002DB0000-0x0000000003DB0000-memory.dmp

Filesize
16.0MB

Download
memory/2552-32-0x0000000002DB0000-0x0000000003DB0000-memory.dmp

Filesize
16.0MB

Download
memory/2552-34-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2552-35-0x0000000000400000-0x0000000000573000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads