modiloader | ace733fd929688fb9cba1a8ecfb05db47c214694a9a993650bd022ab869a9c8a

General

Target

URGENTE_NOTIFICATION.cmd
Size

4.3MB
MD5

10dfd3dccfeaeb1e19e586e5d89ef1c6
SHA1

af3aa6b4249a27778de9e8b2fc2ee6badb0e299a
SHA256

f81c9ad169f7dcfa4545eab3552115156d7923957c1cffc4809a574209599e3c
SHA512

f8b3d6cc712792f1fa567ecf730809c4b49241e6b5fb31961bf8643a2b7a0af3635672cee0d2ac8e02312c1727ec3c01abb7e35ce49a831865d6a16b66b5ce7e
SSDEEP

49152:EEi0F7JFavH5JDy0oqMaKcCln2UE+ESPTcexrEPdOgSlxHgamuc6slj:e

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral5/memory/2396-35-0x0000000003280000-0x0000000004280000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exe

pid process

2576 alpha.exe
2220 alpha.exe
2496 kn.exe
2596 alpha.exe
2636 kn.exe
2396 sppsvc.pif
2508 alpha.exe
2424 alpha.exe
Loads dropped DLL 9 IoCs

Processes:

cmd.exealpha.exealpha.exeWerFault.exe

pid process

1636 cmd.exe
1636 cmd.exe
2220 alpha.exe
1636 cmd.exe
2596 alpha.exe
1636 cmd.exe
1636 cmd.exe
2564 WerFault.exe
2564 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2564 2396 WerFault.exe sppsvc.pif
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

sppsvc.pif

pid process

2396 sppsvc.pif

pid	process
2576	alpha.exe
2220	alpha.exe
2496	kn.exe
2596	alpha.exe
2636	kn.exe
2396	sppsvc.pif
2508	alpha.exe
2424	alpha.exe

pid	process
1636	cmd.exe
1636	cmd.exe
2220	alpha.exe
1636	cmd.exe
2596	alpha.exe
1636	cmd.exe
1636	cmd.exe
2564	WerFault.exe
2564	WerFault.exe

pid	pid_target	process	target process
2564	2396	WerFault.exe	sppsvc.pif

pid	process
2396	sppsvc.pif

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exesppsvc.pif

description	pid	process	target process
PID 1636 wrote to memory of 2288	1636	cmd.exe	extrac32.exe
PID 1636 wrote to memory of 2288	1636	cmd.exe	extrac32.exe
PID 1636 wrote to memory of 2288	1636	cmd.exe	extrac32.exe
PID 1636 wrote to memory of 2576	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2576	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2576	1636	cmd.exe	alpha.exe
PID 2576 wrote to memory of 2216	2576	alpha.exe	extrac32.exe
PID 2576 wrote to memory of 2216	2576	alpha.exe	extrac32.exe
PID 2576 wrote to memory of 2216	2576	alpha.exe	extrac32.exe
PID 1636 wrote to memory of 2220	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2220	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2220	1636	cmd.exe	alpha.exe
PID 2220 wrote to memory of 2496	2220	alpha.exe	kn.exe
PID 2220 wrote to memory of 2496	2220	alpha.exe	kn.exe
PID 2220 wrote to memory of 2496	2220	alpha.exe	kn.exe
PID 1636 wrote to memory of 2596	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2596	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2596	1636	cmd.exe	alpha.exe
PID 2596 wrote to memory of 2636	2596	alpha.exe	kn.exe
PID 2596 wrote to memory of 2636	2596	alpha.exe	kn.exe
PID 2596 wrote to memory of 2636	2596	alpha.exe	kn.exe
PID 1636 wrote to memory of 2396	1636	cmd.exe	sppsvc.pif
PID 1636 wrote to memory of 2396	1636	cmd.exe	sppsvc.pif
PID 1636 wrote to memory of 2396	1636	cmd.exe	sppsvc.pif
PID 1636 wrote to memory of 2396	1636	cmd.exe	sppsvc.pif
PID 1636 wrote to memory of 2508	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2508	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2508	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2424	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2424	1636	cmd.exe	alpha.exe
PID 1636 wrote to memory of 2424	1636	cmd.exe	alpha.exe
PID 2396 wrote to memory of 2564	2396	sppsvc.pif	WerFault.exe
PID 2396 wrote to memory of 2564	2396	sppsvc.pif	WerFault.exe
PID 2396 wrote to memory of 2564	2396	sppsvc.pif	WerFault.exe
PID 2396 wrote to memory of 2564	2396	sppsvc.pif	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\System32\extrac32.exe
  C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
  2⤵
  PID:2288
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\extrac32.exe
    extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
    3⤵
    PID:2216
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
    3⤵
    - Executes dropped EXE
    PID:2496
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
    3⤵
    - Executes dropped EXE
    PID:2636
- C:\Users\Public\Libraries\sppsvc.pif
  C:\Users\Public\Libraries\sppsvc.pif
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 684
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2564
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\sppsvc.pif

Filesize
1.6MB

MD5
38310fb63bad19820d761c97f325896d

SHA1
ca71e8fd075089fa127281b972d99948e2a562e6

SHA256
b8d21812baeb9054f45b0d7544a6ec25029da4d733776aac865f9ce6616fcb07

SHA512
44777aa52a467edcb405c311c1bf29f53bbf1fbf875c842ee8fcc6adbfb487087613ede7265391620850d7f4b69864ca7aae9fa1f1d342bbd8658fcae04d0ad8

Download Submit
C:\Users\Public\sppsvc.rtf

Filesize
3.1MB

MD5
c9b027dae62c2ed28886445584817521

SHA1
f82fb286b3662aedd5f9cc7e62945444eb9fcfe7

SHA256
9cb3033e5e81cbea5c1638b2f6c922dc379fe1089a1e3a84cbc40a39f7e414cb

SHA512
bec913cad1109048c14f182c9ce0720340ffafdea2c6d84d5b676122656b494270dcc3049b6f2833275ccbb6a0009b17efa416114d402251271d991e58c5a44f

Download Submit
\Users\Public\alpha.exe

Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
\Users\Public\kn.exe

Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
memory/2396-30-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2396-34-0x0000000003280000-0x0000000004280000-memory.dmp

Filesize
16.0MB

Download
memory/2396-35-0x0000000003280000-0x0000000004280000-memory.dmp

Filesize
16.0MB

Download
memory/2396-37-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2396-38-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads