modiloader | 969563b96c33286b127298208e5e28ed8a3c5878e34c7df2cb09419fffe726f7

General

Target

23042024_2035_final.cmd
Size

4.4MB
MD5

6094887c2ab95de62b09c2c2b25f8a06
SHA1

b3f8986bdbfa79c5b0314382061bd4e6ff475b17
SHA256

969563b96c33286b127298208e5e28ed8a3c5878e34c7df2cb09419fffe726f7
SHA512

44117de7a710a082661697f2f8b8fb0961f97ab96eac58212890db9646e9ae2a7f118421c9c195bcd983a5f6e96ea1a4a12f1a0075459ad21ad247441d975d46
SSDEEP

49152:rqn6yInGos9t2oOfPUlIVHpkIuT5rOSqcNX6xro0b+mZrRQNMg0Qw9eizGv4:Z

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2776-33-0x0000000003010000-0x0000000004010000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exe

pid process

2648 alpha.exe
2568 alpha.exe
2608 kn.exe
2752 alpha.exe
2660 kn.exe
2776 sppsvc.pif
2548 alpha.exe
2484 alpha.exe
Loads dropped DLL 7 IoCs

Processes:

cmd.exealpha.exealpha.exeWerFault.exe

pid process

2368 cmd.exe
2368 cmd.exe
2568 alpha.exe
2368 cmd.exe
2752 alpha.exe
2512 WerFault.exe
2512 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2512 2776 WerFault.exe sppsvc.pif
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

sppsvc.pif

pid process

2776 sppsvc.pif

pid	process
2648	alpha.exe
2568	alpha.exe
2608	kn.exe
2752	alpha.exe
2660	kn.exe
2776	sppsvc.pif
2548	alpha.exe
2484	alpha.exe

pid	process
2368	cmd.exe
2368	cmd.exe
2568	alpha.exe
2368	cmd.exe
2752	alpha.exe
2512	WerFault.exe
2512	WerFault.exe

pid	pid_target	process	target process
2512	2776	WerFault.exe	sppsvc.pif

pid	process
2776	sppsvc.pif

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exesppsvc.pif

description	pid	process	target process
PID 2368 wrote to memory of 2216	2368	cmd.exe	extrac32.exe
PID 2368 wrote to memory of 2216	2368	cmd.exe	extrac32.exe
PID 2368 wrote to memory of 2216	2368	cmd.exe	extrac32.exe
PID 2368 wrote to memory of 2648	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2648	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2648	2368	cmd.exe	alpha.exe
PID 2648 wrote to memory of 2028	2648	alpha.exe	extrac32.exe
PID 2648 wrote to memory of 2028	2648	alpha.exe	extrac32.exe
PID 2648 wrote to memory of 2028	2648	alpha.exe	extrac32.exe
PID 2368 wrote to memory of 2568	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2568	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2568	2368	cmd.exe	alpha.exe
PID 2568 wrote to memory of 2608	2568	alpha.exe	kn.exe
PID 2568 wrote to memory of 2608	2568	alpha.exe	kn.exe
PID 2568 wrote to memory of 2608	2568	alpha.exe	kn.exe
PID 2368 wrote to memory of 2752	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2752	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2752	2368	cmd.exe	alpha.exe
PID 2752 wrote to memory of 2660	2752	alpha.exe	kn.exe
PID 2752 wrote to memory of 2660	2752	alpha.exe	kn.exe
PID 2752 wrote to memory of 2660	2752	alpha.exe	kn.exe
PID 2368 wrote to memory of 2776	2368	cmd.exe	sppsvc.pif
PID 2368 wrote to memory of 2776	2368	cmd.exe	sppsvc.pif
PID 2368 wrote to memory of 2776	2368	cmd.exe	sppsvc.pif
PID 2368 wrote to memory of 2776	2368	cmd.exe	sppsvc.pif
PID 2368 wrote to memory of 2548	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2548	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2548	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2484	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2484	2368	cmd.exe	alpha.exe
PID 2368 wrote to memory of 2484	2368	cmd.exe	alpha.exe
PID 2776 wrote to memory of 2512	2776	sppsvc.pif	WerFault.exe
PID 2776 wrote to memory of 2512	2776	sppsvc.pif	WerFault.exe
PID 2776 wrote to memory of 2512	2776	sppsvc.pif	WerFault.exe
PID 2776 wrote to memory of 2512	2776	sppsvc.pif	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\23042024_2035_final.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System32\extrac32.exe
  C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
  2⤵
  PID:2216
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\system32\extrac32.exe
    extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
    3⤵
    PID:2028
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\23042024_2035_final.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\23042024_2035_final.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
    3⤵
    - Executes dropped EXE
    PID:2608
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
    3⤵
    - Executes dropped EXE
    PID:2660
- C:\Users\Public\Libraries\sppsvc.pif
  C:\Users\Public\Libraries\sppsvc.pif
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 700
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2512
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\sppsvc.pif

Filesize
1.6MB

MD5
bc05131061626ff2e000be97c251400e

SHA1
8832aaf1cf39b29133025e5661960be72e6f54e0

SHA256
093caf593112fbe0e88c51ceaaff39ae998622031bd5fd2dceccc48f1dd8f40d

SHA512
3cbcf081f96d2d852765f938e2b4273875eb45b74a0bebd07b85f960bfea44145b1f0e8d62527e094a69755f1f4ac5f45576d4507a92eac12a51048c57641c31

Download Submit
C:\Users\Public\alpha.exe

Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
C:\Users\Public\kn.exe

Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
C:\Users\Public\sppsvc.rtf

Filesize
3.2MB

MD5
476ba890f490c6388b38542634afb665

SHA1
860470ca6f55602d45de6a230b0fe6a09bf6b5cc

SHA256
7c4b097337ebe5defe9946d74883f203029661000967bbc7fca0544ef9dc132e

SHA512
ac3bae8c79087de11d3e1ad935c8dba2766696fe9651c5b0267e90d60aa0d5f4069c506af5499cba0686c58cc10710f7a4d323ff37e9297f3d1b7ce20cef98ac

Download Submit
memory/2776-28-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2776-30-0x0000000003010000-0x0000000004010000-memory.dmp

Filesize
16.0MB

Download
memory/2776-33-0x0000000003010000-0x0000000004010000-memory.dmp

Filesize
16.0MB

Download
memory/2776-36-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2776-37-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads