modiloader | 9cf9c777a12e0620c1983d5e1790d6957bb3a713c6d5b569334fe18b99df0870

General

Target

ref_00291882384892.cmd
Size

4.3MB
MD5

23f87d5ed3ef12efda90bf6ba82e2bd6
SHA1

ec451f0de91170a6702547159ef9d189c85d1018
SHA256

c3cffa55b7f7c7f80dd9302c3796b7bce79102ae75e4592d84d165aadf9c0743
SHA512

d849eccfe99697ebeb058f7817af13873e3eeb73fcb78ad8eeb5a6fec89b269533a6e296d53625e69546fce6e0e6942ebe8cb08f5db0a5aadaad3ff23719cd53
SSDEEP

49152:fHZjpt3K90OHGHS/jltrYcZ4t6CgGP9KUJM0tDNm5Rg4/VuqK1BdeW9e6P:9

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2580-35-0x00000000034E0000-0x00000000044E0000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exe

pid process

2616 alpha.exe
3016 alpha.exe
3032 kn.exe
2376 alpha.exe
2992 kn.exe
2580 sppsvc.pif
2648 alpha.exe
2660 alpha.exe
Loads dropped DLL 9 IoCs

Processes:

cmd.exealpha.exealpha.exeWerFault.exe

pid process

1368 cmd.exe
1368 cmd.exe
3016 alpha.exe
1368 cmd.exe
2376 alpha.exe
1368 cmd.exe
1368 cmd.exe
2440 WerFault.exe
2440 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2440 2580 WerFault.exe sppsvc.pif
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

sppsvc.pif

pid process

2580 sppsvc.pif

pid	process
2616	alpha.exe
3016	alpha.exe
3032	kn.exe
2376	alpha.exe
2992	kn.exe
2580	sppsvc.pif
2648	alpha.exe
2660	alpha.exe

pid	process
1368	cmd.exe
1368	cmd.exe
3016	alpha.exe
1368	cmd.exe
2376	alpha.exe
1368	cmd.exe
1368	cmd.exe
2440	WerFault.exe
2440	WerFault.exe

pid	pid_target	process	target process
2440	2580	WerFault.exe	sppsvc.pif

pid	process
2580	sppsvc.pif

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exesppsvc.pif

description	pid	process	target process
PID 1368 wrote to memory of 1956	1368	cmd.exe	extrac32.exe
PID 1368 wrote to memory of 1956	1368	cmd.exe	extrac32.exe
PID 1368 wrote to memory of 1956	1368	cmd.exe	extrac32.exe
PID 1368 wrote to memory of 2616	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 2616	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 2616	1368	cmd.exe	alpha.exe
PID 2616 wrote to memory of 2708	2616	alpha.exe	extrac32.exe
PID 2616 wrote to memory of 2708	2616	alpha.exe	extrac32.exe
PID 2616 wrote to memory of 2708	2616	alpha.exe	extrac32.exe
PID 1368 wrote to memory of 3016	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 3016	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 3016	1368	cmd.exe	alpha.exe
PID 3016 wrote to memory of 3032	3016	alpha.exe	kn.exe
PID 3016 wrote to memory of 3032	3016	alpha.exe	kn.exe
PID 3016 wrote to memory of 3032	3016	alpha.exe	kn.exe
PID 1368 wrote to memory of 2376	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 2376	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 2376	1368	cmd.exe	alpha.exe
PID 2376 wrote to memory of 2992	2376	alpha.exe	kn.exe
PID 2376 wrote to memory of 2992	2376	alpha.exe	kn.exe
PID 2376 wrote to memory of 2992	2376	alpha.exe	kn.exe
PID 1368 wrote to memory of 2580	1368	cmd.exe	sppsvc.pif
PID 1368 wrote to memory of 2580	1368	cmd.exe	sppsvc.pif
PID 1368 wrote to memory of 2580	1368	cmd.exe	sppsvc.pif
PID 1368 wrote to memory of 2580	1368	cmd.exe	sppsvc.pif
PID 1368 wrote to memory of 2648	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 2648	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 2648	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 2660	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 2660	1368	cmd.exe	alpha.exe
PID 1368 wrote to memory of 2660	1368	cmd.exe	alpha.exe
PID 2580 wrote to memory of 2440	2580	sppsvc.pif	WerFault.exe
PID 2580 wrote to memory of 2440	2580	sppsvc.pif	WerFault.exe
PID 2580 wrote to memory of 2440	2580	sppsvc.pif	WerFault.exe
PID 2580 wrote to memory of 2440	2580	sppsvc.pif	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ref_00291882384892.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:1956

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:2708

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\ref_00291882384892.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\ref_00291882384892.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
3⤵
- Executes dropped EXE
PID:3032

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
3⤵
- Executes dropped EXE
PID:2992

C:\Users\Public\Libraries\sppsvc.pif
C:\Users\Public\Libraries\sppsvc.pif
2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 700
3⤵
- Loads dropped DLL
- Program crash
PID:2440

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2648

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\sppsvc.pif
Filesize
1.6MB

MD5
5dc72c0758be865d60ec49da3b18ada6

SHA1
e8f1248535ccb846a25f7cabe6cdd561343854dd

SHA256
18ed0f120637017977b5f606feac6bca90a5cf28839f98c35b6ff3e9b4a0d01f

SHA512
0d4a8d2c01ef7d56bd379c294ff976db61e1ff9fbf56b6c2c1835c8a706954555b8a03fb35b8d21881686363d30ed39f4b2a3a68b9f40a97bcfd60774b53f53e

Download Submit
C:\Users\Public\sppsvc.rtf
Filesize
3.1MB

MD5
dae8075cb28bc2772caf6ff7eaecf90b

SHA1
9153b65e9e1b58039a1efc37a26276f03ffd1c28

SHA256
aebd8a641bf4d2394e1e94f4e2b285f5dae110d68a7a0c524c4261c34b7aad91

SHA512
81632d9ba844b047a5fb9f32c5543bbe6e7fed68e14e7e530d380001b0a368892f21cf3f3875c9334137ed3423b1c37b9e143042951e19a1daaa8ffa2c35f434

Download Submit
\Users\Public\alpha.exe
Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
\Users\Public\kn.exe
Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
memory/2580-29-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2580-34-0x00000000034E0000-0x00000000044E0000-memory.dmp

Filesize
16.0MB

Download
memory/2580-35-0x00000000034E0000-0x00000000044E0000-memory.dmp

Filesize
16.0MB

Download
memory/2580-37-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2580-38-0x0000000000400000-0x0000000000598000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads