modiloader | ace733fd929688fb9cba1a8ecfb05db47c214694a9a993650bd022ab869a9c8a

General

Target

URGENTE_NOTIFICATION.cmd
Size

4.3MB
MD5

10dfd3dccfeaeb1e19e586e5d89ef1c6
SHA1

af3aa6b4249a27778de9e8b2fc2ee6badb0e299a
SHA256

f81c9ad169f7dcfa4545eab3552115156d7923957c1cffc4809a574209599e3c
SHA512

f8b3d6cc712792f1fa567ecf730809c4b49241e6b5fb31961bf8643a2b7a0af3635672cee0d2ac8e02312c1727ec3c01abb7e35ce49a831865d6a16b66b5ce7e
SSDEEP

49152:EEi0F7JFavH5JDy0oqMaKcCln2UE+ESPTcexrEPdOgSlxHgamuc6slj:e

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral6/memory/2432-30-0x0000000002840000-0x0000000003840000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exe

pid process

2268 alpha.exe
2284 alpha.exe
692 kn.exe
2384 alpha.exe
1648 kn.exe
2432 sppsvc.pif
4940 alpha.exe
208 alpha.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

9 drive.google.com
11 drive.google.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3980 2432 WerFault.exe sppsvc.pif

pid	process
2268	alpha.exe
2284	alpha.exe
692	kn.exe
2384	alpha.exe
1648	kn.exe
2432	sppsvc.pif
4940	alpha.exe
208	alpha.exe

flow	ioc
9	drive.google.com
11	drive.google.com

pid	pid_target	process	target process
3980	2432	WerFault.exe	sppsvc.pif

Script User-Agent 7 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exe

description	pid	process	target process
PID 3936 wrote to memory of 912	3936	cmd.exe	extrac32.exe
PID 3936 wrote to memory of 912	3936	cmd.exe	extrac32.exe
PID 3936 wrote to memory of 2268	3936	cmd.exe	alpha.exe
PID 3936 wrote to memory of 2268	3936	cmd.exe	alpha.exe
PID 2268 wrote to memory of 2208	2268	alpha.exe	extrac32.exe
PID 2268 wrote to memory of 2208	2268	alpha.exe	extrac32.exe
PID 3936 wrote to memory of 2284	3936	cmd.exe	alpha.exe
PID 3936 wrote to memory of 2284	3936	cmd.exe	alpha.exe
PID 2284 wrote to memory of 692	2284	alpha.exe	kn.exe
PID 2284 wrote to memory of 692	2284	alpha.exe	kn.exe
PID 3936 wrote to memory of 2384	3936	cmd.exe	alpha.exe
PID 3936 wrote to memory of 2384	3936	cmd.exe	alpha.exe
PID 2384 wrote to memory of 1648	2384	alpha.exe	kn.exe
PID 2384 wrote to memory of 1648	2384	alpha.exe	kn.exe
PID 3936 wrote to memory of 2432	3936	cmd.exe	sppsvc.pif
PID 3936 wrote to memory of 2432	3936	cmd.exe	sppsvc.pif
PID 3936 wrote to memory of 2432	3936	cmd.exe	sppsvc.pif
PID 3936 wrote to memory of 4940	3936	cmd.exe	alpha.exe
PID 3936 wrote to memory of 4940	3936	cmd.exe	alpha.exe
PID 3936 wrote to memory of 208	3936	cmd.exe	alpha.exe
PID 3936 wrote to memory of 208	3936	cmd.exe	alpha.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:912

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:2208

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
3⤵
- Executes dropped EXE
PID:692

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
3⤵
- Executes dropped EXE
PID:1648

C:\Users\Public\Libraries\sppsvc.pif
C:\Users\Public\Libraries\sppsvc.pif
2⤵
- Executes dropped EXE
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 1628
3⤵
- Program crash
PID:3980

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:4940

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\sppsvc.pif
Filesize
1.6MB

MD5
38310fb63bad19820d761c97f325896d

SHA1
ca71e8fd075089fa127281b972d99948e2a562e6

SHA256
b8d21812baeb9054f45b0d7544a6ec25029da4d733776aac865f9ce6616fcb07

SHA512
44777aa52a467edcb405c311c1bf29f53bbf1fbf875c842ee8fcc6adbfb487087613ede7265391620850d7f4b69864ca7aae9fa1f1d342bbd8658fcae04d0ad8

Download Submit
C:\Users\Public\alpha.exe
Filesize
265KB

MD5
94912c1d73ade68f2486ed4d8ea82de6

SHA1
524ab0a40594d2b5f620f542e87a45472979a416

SHA256
9f7ebb79def0bf8cccb5a902db11746375af3fe618355fe5a69c69e4bcd50ac9

SHA512
f48a3b7a2e6426c0091bb159599921b8e4644c8ae83a2a2a82efc9d3e21e4e343d77339917d8aabed6d8025142a2a8e74bf1fa759edb6146bc6e39fbece9e05d

Download Submit
C:\Users\Public\kn.exe
Filesize
1.4MB

MD5
056c7d065f4622da9cc2848f47e2bae2

SHA1
6c6f18b0ec53dc63488961c4240ec584ac71c25f

SHA256
e09a2d7ecac1a10c89e27750a18790da06ddd7311965dbc9ab6096f636dae61c

SHA512
db158c9b669a2668149caf30df32595a488dcc831d7518ca2e793eac0885492a2eaee838914e706a585b7f3f1c801e299c697b2cec509204561bb098e16253d5

Download Submit
C:\Users\Public\sppsvc.rtf
Filesize
3.1MB

MD5
c9b027dae62c2ed28886445584817521

SHA1
f82fb286b3662aedd5f9cc7e62945444eb9fcfe7

SHA256
9cb3033e5e81cbea5c1638b2f6c922dc379fe1089a1e3a84cbc40a39f7e414cb

SHA512
bec913cad1109048c14f182c9ce0720340ffafdea2c6d84d5b676122656b494270dcc3049b6f2833275ccbb6a0009b17efa416114d402251271d991e58c5a44f

Download Submit
memory/2432-28-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/2432-29-0x0000000002840000-0x0000000003840000-memory.dmp

Filesize
16.0MB

Download
memory/2432-30-0x0000000002840000-0x0000000003840000-memory.dmp

Filesize
16.0MB

Download
memory/2432-32-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads