modiloader | d23b1e9ce21335de1ccfebc24b556c14bf193fd025167d68e0af9e061f9b02bd

General

Target

d23b1e9ce21335de1ccfebc24b556c14bf193fd025167d68e0af9e061f9b02bd.bat
Size

4.7MB
MD5

55f48dd51a9f5e43d1c206ad4f972661
SHA1

dcdb11a9f0d5b2ac01600737f96383550096ac4a
SHA256

d23b1e9ce21335de1ccfebc24b556c14bf193fd025167d68e0af9e061f9b02bd
SHA512

08f343befefbeb42c302518092d3832f5b27e43fa9003a05822523b39ac38d53f49711af9dd165cbd1b1d906fdf711486ac875954990849007422971fee0ac1e
SSDEEP

49152:KqDXIfW2UShFhv2Nym/GmpXhvPBi3M5xfrcjKiUns19M8X0KtC8v7sMDlZg6HcNn:R

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2648-35-0x0000000003070000-0x0000000004070000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exedisktop.pifalpha.exealpha.exe

pid process

2352 alpha.exe
2712 alpha.exe
2012 kn.exe
2536 alpha.exe
2580 kn.exe
2648 disktop.pif
2624 alpha.exe
2084 alpha.exe
Loads dropped DLL 9 IoCs

Processes:

cmd.exealpha.exealpha.exeWerFault.exe

pid process

2176 cmd.exe
2176 cmd.exe
2712 alpha.exe
2176 cmd.exe
2536 alpha.exe
2176 cmd.exe
2176 cmd.exe
2448 WerFault.exe
2448 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2448 2648 WerFault.exe disktop.pif
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

disktop.pif

pid process

2648 disktop.pif

pid	process
2352	alpha.exe
2712	alpha.exe
2012	kn.exe
2536	alpha.exe
2580	kn.exe
2648	disktop.pif
2624	alpha.exe
2084	alpha.exe

pid	process
2176	cmd.exe
2176	cmd.exe
2712	alpha.exe
2176	cmd.exe
2536	alpha.exe
2176	cmd.exe
2176	cmd.exe
2448	WerFault.exe
2448	WerFault.exe

pid	pid_target	process	target process
2448	2648	WerFault.exe	disktop.pif

pid	process
2648	disktop.pif

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exedisktop.pif

description	pid	process	target process
PID 2176 wrote to memory of 2196	2176	cmd.exe	extrac32.exe
PID 2176 wrote to memory of 2196	2176	cmd.exe	extrac32.exe
PID 2176 wrote to memory of 2196	2176	cmd.exe	extrac32.exe
PID 2176 wrote to memory of 2352	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2352	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2352	2176	cmd.exe	alpha.exe
PID 2352 wrote to memory of 2288	2352	alpha.exe	extrac32.exe
PID 2352 wrote to memory of 2288	2352	alpha.exe	extrac32.exe
PID 2352 wrote to memory of 2288	2352	alpha.exe	extrac32.exe
PID 2176 wrote to memory of 2712	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2712	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2712	2176	cmd.exe	alpha.exe
PID 2712 wrote to memory of 2012	2712	alpha.exe	kn.exe
PID 2712 wrote to memory of 2012	2712	alpha.exe	kn.exe
PID 2712 wrote to memory of 2012	2712	alpha.exe	kn.exe
PID 2176 wrote to memory of 2536	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2536	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2536	2176	cmd.exe	alpha.exe
PID 2536 wrote to memory of 2580	2536	alpha.exe	kn.exe
PID 2536 wrote to memory of 2580	2536	alpha.exe	kn.exe
PID 2536 wrote to memory of 2580	2536	alpha.exe	kn.exe
PID 2176 wrote to memory of 2648	2176	cmd.exe	disktop.pif
PID 2176 wrote to memory of 2648	2176	cmd.exe	disktop.pif
PID 2176 wrote to memory of 2648	2176	cmd.exe	disktop.pif
PID 2176 wrote to memory of 2648	2176	cmd.exe	disktop.pif
PID 2176 wrote to memory of 2624	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2624	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2624	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2084	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2084	2176	cmd.exe	alpha.exe
PID 2176 wrote to memory of 2084	2176	cmd.exe	alpha.exe
PID 2648 wrote to memory of 2448	2648	disktop.pif	WerFault.exe
PID 2648 wrote to memory of 2448	2648	disktop.pif	WerFault.exe
PID 2648 wrote to memory of 2448	2648	disktop.pif	WerFault.exe
PID 2648 wrote to memory of 2448	2648	disktop.pif	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\d23b1e9ce21335de1ccfebc24b556c14bf193fd025167d68e0af9e061f9b02bd.bat"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:2196

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:2288

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\d23b1e9ce21335de1ccfebc24b556c14bf193fd025167d68e0af9e061f9b02bd.bat" "C:\\Users\\Public\\disktop.ini" 9
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\d23b1e9ce21335de1ccfebc24b556c14bf193fd025167d68e0af9e061f9b02bd.bat" "C:\\Users\\Public\\disktop.ini" 9
3⤵
- Executes dropped EXE
PID:2012

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\disktop.ini" "C:\\Users\\Public\\Libraries\\disktop.pif" 12
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\disktop.ini" "C:\\Users\\Public\\Libraries\\disktop.pif" 12
3⤵
- Executes dropped EXE
PID:2580

C:\Users\Public\Libraries\disktop.pif
C:\Users\Public\Libraries\disktop.pif
2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 680
3⤵
- Loads dropped DLL
- Program crash
PID:2448

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\disktop.ini" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2624

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\disktop.pif
Filesize
1.7MB

MD5
2c2669d4ac3f6c83a72b2c6eecb57368

SHA1
448318f3d65cb965ece84fa6f7000cf4af374366

SHA256
7a8be3eba0171a9ee5bf7ed6359181ec36676bc0434acbb106af0a57829aca74

SHA512
369de9b34af19530c12f61c481debae35df065ea13cd15e096a8444c612045cbe93a52e80b02d586740bca10289e204b3c37284c9a67b1ebb345f95f2fc3410f

Download Submit
C:\Users\Public\disktop.ini
Filesize
3.4MB

MD5
942dc36e982c57b8aee62a93c1881bdc

SHA1
1c0c70085134d166309a3748466f2cc33c1e1947

SHA256
b4d43caf6a7c83b7e5f9d3eddd640649dcd323cbb9764a5dd750a3d5022f49cc

SHA512
fce82b46a6595df3b2b38dc8253369c4b897b454d47441c79e84f522002c9718e5cc28811812ad1e189ca2a13a952e81fdfff15a51998aa3db1aa94b92f2530c

Download Submit
C:\Users\Public\kn.exe
Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
\Users\Public\alpha.exe
Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
memory/2648-29-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2648-34-0x0000000003070000-0x0000000004070000-memory.dmp

Filesize
16.0MB

Download
memory/2648-35-0x0000000003070000-0x0000000004070000-memory.dmp

Filesize
16.0MB

Download
memory/2648-37-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2648-38-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads