modiloader | 851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208

General

Target

851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat
Size

3.2MB
MD5

b766a151851fff661fd05df17c722fe0
SHA1

b72ca0ded29114b5d4f333e2c8d32f37f075c059
SHA256

851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208
SHA512

1940cf3c9b83c4298d6beffc612657e379073dfce854b14306919d5fe8a73c888906cdeebdb7803f3ab5ae41a44a0b04fc2520d675dc9ebd253dce4ad0faae60
SSDEEP

49152:Xf2itfXve4rdS832GjhZqBaN6y3L8boHHTA0:Z

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2608-34-0x0000000002D20000-0x0000000003D20000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exeYano.comalpha.exealpha.exe

pid process

1856 alpha.exe
2160 alpha.exe
2496 kn.exe
2600 alpha.exe
2616 kn.exe
2608 Yano.com
2540 alpha.exe
2712 alpha.exe
Loads dropped DLL 7 IoCs

Processes:

cmd.exealpha.exealpha.exeWerFault.exe

pid process

1712 cmd.exe
1712 cmd.exe
2160 alpha.exe
1712 cmd.exe
2600 alpha.exe
2584 WerFault.exe
2584 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2584 2608 WerFault.exe Yano.com
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

Yano.com

pid process

2608 Yano.com

pid	process
1856	alpha.exe
2160	alpha.exe
2496	kn.exe
2600	alpha.exe
2616	kn.exe
2608	Yano.com
2540	alpha.exe
2712	alpha.exe

pid	process
1712	cmd.exe
1712	cmd.exe
2160	alpha.exe
1712	cmd.exe
2600	alpha.exe
2584	WerFault.exe
2584	WerFault.exe

pid	pid_target	process	target process
2584	2608	WerFault.exe	Yano.com

pid	process
2608	Yano.com

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exeYano.com

description	pid	process	target process
PID 1712 wrote to memory of 1864	1712	cmd.exe	extrac32.exe
PID 1712 wrote to memory of 1864	1712	cmd.exe	extrac32.exe
PID 1712 wrote to memory of 1864	1712	cmd.exe	extrac32.exe
PID 1712 wrote to memory of 1856	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 1856	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 1856	1712	cmd.exe	alpha.exe
PID 1856 wrote to memory of 1872	1856	alpha.exe	extrac32.exe
PID 1856 wrote to memory of 1872	1856	alpha.exe	extrac32.exe
PID 1856 wrote to memory of 1872	1856	alpha.exe	extrac32.exe
PID 1712 wrote to memory of 2160	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2160	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2160	1712	cmd.exe	alpha.exe
PID 2160 wrote to memory of 2496	2160	alpha.exe	kn.exe
PID 2160 wrote to memory of 2496	2160	alpha.exe	kn.exe
PID 2160 wrote to memory of 2496	2160	alpha.exe	kn.exe
PID 1712 wrote to memory of 2600	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2600	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2600	1712	cmd.exe	alpha.exe
PID 2600 wrote to memory of 2616	2600	alpha.exe	kn.exe
PID 2600 wrote to memory of 2616	2600	alpha.exe	kn.exe
PID 2600 wrote to memory of 2616	2600	alpha.exe	kn.exe
PID 1712 wrote to memory of 2608	1712	cmd.exe	Yano.com
PID 1712 wrote to memory of 2608	1712	cmd.exe	Yano.com
PID 1712 wrote to memory of 2608	1712	cmd.exe	Yano.com
PID 1712 wrote to memory of 2608	1712	cmd.exe	Yano.com
PID 1712 wrote to memory of 2540	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2540	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2540	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2712	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2712	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2712	1712	cmd.exe	alpha.exe
PID 2608 wrote to memory of 2584	2608	Yano.com	WerFault.exe
PID 2608 wrote to memory of 2584	2608	Yano.com	WerFault.exe
PID 2608 wrote to memory of 2584	2608	Yano.com	WerFault.exe
PID 2608 wrote to memory of 2584	2608	Yano.com	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:1864

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:1872

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\851b1f4779b2875dcbb966c5c062d4766655c3d5d94693c93b33ec66fcd8f208.bat" "C:\\Users\\Public\\Yano.txt" 9
3⤵
- Executes dropped EXE
PID:2496

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Yano.txt" "C:\\Users\\Public\\Libraries\\Yano.com" 12
3⤵
- Executes dropped EXE
PID:2616

C:\Users\Public\Libraries\Yano.com
C:\Users\Public\Libraries\Yano.com
2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 792
3⤵
- Loads dropped DLL
- Program crash
PID:2584

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\Yano.txt" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2540

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\Yano.com

Filesize
1.2MB

MD5
6e81d417826597c23f59c6dc8d0e9325

SHA1
6b8f936e6d7249471d1acdf5e3ec50faea11211a

SHA256
92286b5317d643787e4109d2d7354e94593416720d0b8f8aa2d497a16a24f377

SHA512
37dfc57c6ada7b379150c1085dcef8b01b4e950f011bc45f50889c883ff28d33a0be4fb0a66f1b1a8d862a6e37dcaf1f810b66bd094b7baff5cfb8f041d198cc

Download Submit
C:\Users\Public\Yano.txt

Filesize
2.3MB

MD5
4cf5c11880ee66463fbbbd2d00371d09

SHA1
9c438f3129d126279e62d738ced076daf88090af

SHA256
47b157a5a99f3304a954236dd5f85978bd8dfb8a741abefd2798dfc2b2e2a8c7

SHA512
0915ee260c1e625779b7036c049bd2aafc43852d5585f3674bebca41189025db9c13d9cc4543fde579f61128c815107b5d765cc45e24e4f109f4aaf41038a9ce

Download Submit
C:\Users\Public\kn.exe

Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
\Users\Public\alpha.exe

Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
memory/2608-28-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2608-33-0x0000000002D20000-0x0000000003D20000-memory.dmp

Filesize
16.0MB

Download
memory/2608-34-0x0000000002D20000-0x0000000003D20000-memory.dmp

Filesize
16.0MB

Download
memory/2608-36-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2608-37-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads