modiloader | ace733fd929688fb9cba1a8ecfb05db47c214694a9a993650bd022ab869a9c8a

General

Target

URGENTE_NOTIFICATION.cmd
Size

4.3MB
MD5

10dfd3dccfeaeb1e19e586e5d89ef1c6
SHA1

af3aa6b4249a27778de9e8b2fc2ee6badb0e299a
SHA256

f81c9ad169f7dcfa4545eab3552115156d7923957c1cffc4809a574209599e3c
SHA512

f8b3d6cc712792f1fa567ecf730809c4b49241e6b5fb31961bf8643a2b7a0af3635672cee0d2ac8e02312c1727ec3c01abb7e35ce49a831865d6a16b66b5ce7e
SSDEEP

49152:EEi0F7JFavH5JDy0oqMaKcCln2UE+ESPTcexrEPdOgSlxHgamuc6slj:e

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral7/memory/3092-30-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exe

pid process

1868 alpha.exe
2240 alpha.exe
3388 kn.exe
4484 alpha.exe
3312 kn.exe
3092 sppsvc.pif
116 alpha.exe
2980 alpha.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

28 drive.google.com
30 drive.google.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5036 3092 WerFault.exe sppsvc.pif

pid	process
1868	alpha.exe
2240	alpha.exe
3388	kn.exe
4484	alpha.exe
3312	kn.exe
3092	sppsvc.pif
116	alpha.exe
2980	alpha.exe

flow	ioc
28	drive.google.com
30	drive.google.com

pid	pid_target	process	target process
5036	3092	WerFault.exe	sppsvc.pif

Script User-Agent 7 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	38	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	30	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	33	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exe

description	pid	process	target process
PID 636 wrote to memory of 4896	636	cmd.exe	extrac32.exe
PID 636 wrote to memory of 4896	636	cmd.exe	extrac32.exe
PID 636 wrote to memory of 1868	636	cmd.exe	alpha.exe
PID 636 wrote to memory of 1868	636	cmd.exe	alpha.exe
PID 1868 wrote to memory of 4936	1868	alpha.exe	extrac32.exe
PID 1868 wrote to memory of 4936	1868	alpha.exe	extrac32.exe
PID 636 wrote to memory of 2240	636	cmd.exe	alpha.exe
PID 636 wrote to memory of 2240	636	cmd.exe	alpha.exe
PID 2240 wrote to memory of 3388	2240	alpha.exe	kn.exe
PID 2240 wrote to memory of 3388	2240	alpha.exe	kn.exe
PID 636 wrote to memory of 4484	636	cmd.exe	alpha.exe
PID 636 wrote to memory of 4484	636	cmd.exe	alpha.exe
PID 4484 wrote to memory of 3312	4484	alpha.exe	kn.exe
PID 4484 wrote to memory of 3312	4484	alpha.exe	kn.exe
PID 636 wrote to memory of 3092	636	cmd.exe	sppsvc.pif
PID 636 wrote to memory of 3092	636	cmd.exe	sppsvc.pif
PID 636 wrote to memory of 3092	636	cmd.exe	sppsvc.pif
PID 636 wrote to memory of 116	636	cmd.exe	alpha.exe
PID 636 wrote to memory of 116	636	cmd.exe	alpha.exe
PID 636 wrote to memory of 2980	636	cmd.exe	alpha.exe
PID 636 wrote to memory of 2980	636	cmd.exe	alpha.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\System32\extrac32.exe
  C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
  2⤵
  PID:4896
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\extrac32.exe
    extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
    3⤵
    PID:4936
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
    3⤵
    - Executes dropped EXE
    PID:3388
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
    3⤵
    - Executes dropped EXE
    PID:3312
- C:\Users\Public\Libraries\sppsvc.pif
  C:\Users\Public\Libraries\sppsvc.pif
  2⤵
  - Executes dropped EXE
  PID:3092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 1456
    3⤵
    - Program crash
    PID:5036
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3092 -ip 3092
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\sppsvc.pif

Filesize
1.6MB

MD5
38310fb63bad19820d761c97f325896d

SHA1
ca71e8fd075089fa127281b972d99948e2a562e6

SHA256
b8d21812baeb9054f45b0d7544a6ec25029da4d733776aac865f9ce6616fcb07

SHA512
44777aa52a467edcb405c311c1bf29f53bbf1fbf875c842ee8fcc6adbfb487087613ede7265391620850d7f4b69864ca7aae9fa1f1d342bbd8658fcae04d0ad8

Download Submit
C:\Users\Public\alpha.exe

Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Users\Public\kn.exe

Filesize
1.6MB

MD5
bd8d9943a9b1def98eb83e0fa48796c2

SHA1
70e89852f023ab7cde0173eda1208dbb580f1e4f

SHA256
8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

SHA512
95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

Download Submit
C:\Users\Public\sppsvc.rtf

Filesize
3.1MB

MD5
c9b027dae62c2ed28886445584817521

SHA1
f82fb286b3662aedd5f9cc7e62945444eb9fcfe7

SHA256
9cb3033e5e81cbea5c1638b2f6c922dc379fe1089a1e3a84cbc40a39f7e414cb

SHA512
bec913cad1109048c14f182c9ce0720340ffafdea2c6d84d5b676122656b494270dcc3049b6f2833275ccbb6a0009b17efa416114d402251271d991e58c5a44f

Download Submit
memory/3092-28-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/3092-29-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/3092-30-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/3092-32-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3092-34-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads