modiloader | d23b1e9ce21335de1ccfebc24b556c14bf193fd025167d68e0af9e061f9b02bd

General

Target

NEW ORDER 04154SHOP N0AWE12893.bat
Size

4.7MB
MD5

55f48dd51a9f5e43d1c206ad4f972661
SHA1

dcdb11a9f0d5b2ac01600737f96383550096ac4a
SHA256

d23b1e9ce21335de1ccfebc24b556c14bf193fd025167d68e0af9e061f9b02bd
SHA512

08f343befefbeb42c302518092d3832f5b27e43fa9003a05822523b39ac38d53f49711af9dd165cbd1b1d906fdf711486ac875954990849007422971fee0ac1e
SSDEEP

49152:KqDXIfW2UShFhv2Nym/GmpXhvPBi3M5xfrcjKiUns19M8X0KtC8v7sMDlZg6HcNn:R

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2656-35-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exedisktop.pifalpha.exealpha.exe

pid process

2472 alpha.exe
2640 alpha.exe
2796 kn.exe
2488 alpha.exe
2664 kn.exe
2656 disktop.pif
2568 alpha.exe
2676 alpha.exe
Loads dropped DLL 9 IoCs

Processes:

cmd.exealpha.exealpha.exeWerFault.exe

pid process

2240 cmd.exe
2240 cmd.exe
2640 alpha.exe
2240 cmd.exe
2488 alpha.exe
2240 cmd.exe
2240 cmd.exe
1528 WerFault.exe
1528 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 2656 WerFault.exe disktop.pif
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

disktop.pif

pid process

2656 disktop.pif

pid	process
2472	alpha.exe
2640	alpha.exe
2796	kn.exe
2488	alpha.exe
2664	kn.exe
2656	disktop.pif
2568	alpha.exe
2676	alpha.exe

pid	process
2240	cmd.exe
2240	cmd.exe
2640	alpha.exe
2240	cmd.exe
2488	alpha.exe
2240	cmd.exe
2240	cmd.exe
1528	WerFault.exe
1528	WerFault.exe

pid	pid_target	process	target process
1528	2656	WerFault.exe	disktop.pif

pid	process
2656	disktop.pif

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exedisktop.pif

description	pid	process	target process
PID 2240 wrote to memory of 2936	2240	cmd.exe	extrac32.exe
PID 2240 wrote to memory of 2936	2240	cmd.exe	extrac32.exe
PID 2240 wrote to memory of 2936	2240	cmd.exe	extrac32.exe
PID 2240 wrote to memory of 2472	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2472	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2472	2240	cmd.exe	alpha.exe
PID 2472 wrote to memory of 2492	2472	alpha.exe	extrac32.exe
PID 2472 wrote to memory of 2492	2472	alpha.exe	extrac32.exe
PID 2472 wrote to memory of 2492	2472	alpha.exe	extrac32.exe
PID 2240 wrote to memory of 2640	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2640	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2640	2240	cmd.exe	alpha.exe
PID 2640 wrote to memory of 2796	2640	alpha.exe	kn.exe
PID 2640 wrote to memory of 2796	2640	alpha.exe	kn.exe
PID 2640 wrote to memory of 2796	2640	alpha.exe	kn.exe
PID 2240 wrote to memory of 2488	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2488	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2488	2240	cmd.exe	alpha.exe
PID 2488 wrote to memory of 2664	2488	alpha.exe	kn.exe
PID 2488 wrote to memory of 2664	2488	alpha.exe	kn.exe
PID 2488 wrote to memory of 2664	2488	alpha.exe	kn.exe
PID 2240 wrote to memory of 2656	2240	cmd.exe	disktop.pif
PID 2240 wrote to memory of 2656	2240	cmd.exe	disktop.pif
PID 2240 wrote to memory of 2656	2240	cmd.exe	disktop.pif
PID 2240 wrote to memory of 2656	2240	cmd.exe	disktop.pif
PID 2240 wrote to memory of 2568	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2568	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2568	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2676	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2676	2240	cmd.exe	alpha.exe
PID 2240 wrote to memory of 2676	2240	cmd.exe	alpha.exe
PID 2656 wrote to memory of 1528	2656	disktop.pif	WerFault.exe
PID 2656 wrote to memory of 1528	2656	disktop.pif	WerFault.exe
PID 2656 wrote to memory of 1528	2656	disktop.pif	WerFault.exe
PID 2656 wrote to memory of 1528	2656	disktop.pif	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\NEW ORDER 04154SHOP N0AWE12893.bat"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:2936

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:2492

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\NEW ORDER 04154SHOP N0AWE12893.bat" "C:\\Users\\Public\\disktop.ini" 9
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\NEW ORDER 04154SHOP N0AWE12893.bat" "C:\\Users\\Public\\disktop.ini" 9
3⤵
- Executes dropped EXE
PID:2796

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\disktop.ini" "C:\\Users\\Public\\Libraries\\disktop.pif" 12
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\disktop.ini" "C:\\Users\\Public\\Libraries\\disktop.pif" 12
3⤵
- Executes dropped EXE
PID:2664

C:\Users\Public\Libraries\disktop.pif
C:\Users\Public\Libraries\disktop.pif
2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 696
3⤵
- Loads dropped DLL
- Program crash
PID:1528

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\disktop.ini" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2568

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\disktop.pif

Filesize
1.7MB

MD5
2c2669d4ac3f6c83a72b2c6eecb57368

SHA1
448318f3d65cb965ece84fa6f7000cf4af374366

SHA256
7a8be3eba0171a9ee5bf7ed6359181ec36676bc0434acbb106af0a57829aca74

SHA512
369de9b34af19530c12f61c481debae35df065ea13cd15e096a8444c612045cbe93a52e80b02d586740bca10289e204b3c37284c9a67b1ebb345f95f2fc3410f

Download Submit
C:\Users\Public\disktop.ini

Filesize
3.4MB

MD5
942dc36e982c57b8aee62a93c1881bdc

SHA1
1c0c70085134d166309a3748466f2cc33c1e1947

SHA256
b4d43caf6a7c83b7e5f9d3eddd640649dcd323cbb9764a5dd750a3d5022f49cc

SHA512
fce82b46a6595df3b2b38dc8253369c4b897b454d47441c79e84f522002c9718e5cc28811812ad1e189ca2a13a952e81fdfff15a51998aa3db1aa94b92f2530c

Download Submit
\Users\Public\alpha.exe

Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
\Users\Public\kn.exe

Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
memory/2656-29-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2656-34-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/2656-35-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/2656-37-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2656-38-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads