modiloader | ace733fd929688fb9cba1a8ecfb05db47c214694a9a993650bd022ab869a9c8a

General

Target

URGENTE_NOTIFICATION.cmd
Size

4.3MB
MD5

10dfd3dccfeaeb1e19e586e5d89ef1c6
SHA1

af3aa6b4249a27778de9e8b2fc2ee6badb0e299a
SHA256

f81c9ad169f7dcfa4545eab3552115156d7923957c1cffc4809a574209599e3c
SHA512

f8b3d6cc712792f1fa567ecf730809c4b49241e6b5fb31961bf8643a2b7a0af3635672cee0d2ac8e02312c1727ec3c01abb7e35ce49a831865d6a16b66b5ce7e
SSDEEP

49152:EEi0F7JFavH5JDy0oqMaKcCln2UE+ESPTcexrEPdOgSlxHgamuc6slj:e

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral8/memory/3392-30-0x0000000002AE0000-0x0000000003AE0000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exe

pid process

1572 alpha.exe
1204 alpha.exe
3880 kn.exe
1380 alpha.exe
4272 kn.exe
3392 sppsvc.pif
3664 alpha.exe
3512 alpha.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

6 drive.google.com
9 drive.google.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3724 3392 WerFault.exe sppsvc.pif

pid	process
1572	alpha.exe
1204	alpha.exe
3880	kn.exe
1380	alpha.exe
4272	kn.exe
3392	sppsvc.pif
3664	alpha.exe
3512	alpha.exe

flow	ioc
6	drive.google.com
9	drive.google.com

pid	pid_target	process	target process
3724	3392	WerFault.exe	sppsvc.pif

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exe

description	pid	process	target process
PID 4972 wrote to memory of 4896	4972	cmd.exe	extrac32.exe
PID 4972 wrote to memory of 4896	4972	cmd.exe	extrac32.exe
PID 4972 wrote to memory of 1572	4972	cmd.exe	alpha.exe
PID 4972 wrote to memory of 1572	4972	cmd.exe	alpha.exe
PID 1572 wrote to memory of 3128	1572	alpha.exe	extrac32.exe
PID 1572 wrote to memory of 3128	1572	alpha.exe	extrac32.exe
PID 4972 wrote to memory of 1204	4972	cmd.exe	alpha.exe
PID 4972 wrote to memory of 1204	4972	cmd.exe	alpha.exe
PID 1204 wrote to memory of 3880	1204	alpha.exe	kn.exe
PID 1204 wrote to memory of 3880	1204	alpha.exe	kn.exe
PID 4972 wrote to memory of 1380	4972	cmd.exe	alpha.exe
PID 4972 wrote to memory of 1380	4972	cmd.exe	alpha.exe
PID 1380 wrote to memory of 4272	1380	alpha.exe	kn.exe
PID 1380 wrote to memory of 4272	1380	alpha.exe	kn.exe
PID 4972 wrote to memory of 3392	4972	cmd.exe	sppsvc.pif
PID 4972 wrote to memory of 3392	4972	cmd.exe	sppsvc.pif
PID 4972 wrote to memory of 3392	4972	cmd.exe	sppsvc.pif
PID 4972 wrote to memory of 3664	4972	cmd.exe	alpha.exe
PID 4972 wrote to memory of 3664	4972	cmd.exe	alpha.exe
PID 4972 wrote to memory of 3512	4972	cmd.exe	alpha.exe
PID 4972 wrote to memory of 3512	4972	cmd.exe	alpha.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:4896

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:3128

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
3⤵
- Executes dropped EXE
PID:3880

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
3⤵
- Executes dropped EXE
PID:4272

C:\Users\Public\Libraries\sppsvc.pif
C:\Users\Public\Libraries\sppsvc.pif
2⤵
- Executes dropped EXE
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 1972
3⤵
- Program crash
PID:3724

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:3664

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 3392 -ip 3392
1⤵
PID:1796

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\sppsvc.pif
Filesize
1.6MB

MD5
38310fb63bad19820d761c97f325896d

SHA1
ca71e8fd075089fa127281b972d99948e2a562e6

SHA256
b8d21812baeb9054f45b0d7544a6ec25029da4d733776aac865f9ce6616fcb07

SHA512
44777aa52a467edcb405c311c1bf29f53bbf1fbf875c842ee8fcc6adbfb487087613ede7265391620850d7f4b69864ca7aae9fa1f1d342bbd8658fcae04d0ad8

Download Submit
C:\Users\Public\alpha.exe
Filesize
324KB

MD5
c5db7b712f280c3ae4f731ad7d5ea171

SHA1
e8717ff0d40e01fd3b06de2aa5a401bed1c907cc

SHA256
f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba

SHA512
bceaf7dc30f2c99b40b7025a5eb063f3131a1ef9349fdf356720eaef838bcf58ce3d5e3bad9459ddd2f872df430bdb66a766a5acff5d3bbc738eba8945cb0a89

Download Submit
C:\Users\Public\kn.exe
Filesize
1.5MB

MD5
3f6129c8d136b6775175a28667ae6c46

SHA1
6e077884cbf7b31e5d7bc6217363fdad967457db

SHA256
43a570f7e49436fa2687b82fb870b31c7af346d66e2622b56c03bfea28b88646

SHA512
2208acea780df21cc4c227d8f7f60973d54679037ffd0f4f67a7412105a5b9d4abf46d425645e922c859d7bdc3b81e7500ae4aa5d9330dc5fcd8618bc3994ff0

Download Submit
C:\Users\Public\sppsvc.rtf
Filesize
3.1MB

MD5
c9b027dae62c2ed28886445584817521

SHA1
f82fb286b3662aedd5f9cc7e62945444eb9fcfe7

SHA256
9cb3033e5e81cbea5c1638b2f6c922dc379fe1089a1e3a84cbc40a39f7e414cb

SHA512
bec913cad1109048c14f182c9ce0720340ffafdea2c6d84d5b676122656b494270dcc3049b6f2833275ccbb6a0009b17efa416114d402251271d991e58c5a44f

Download Submit
memory/3392-28-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/3392-29-0x0000000002AE0000-0x0000000003AE0000-memory.dmp

Filesize
16.0MB

Download
memory/3392-30-0x0000000002AE0000-0x0000000003AE0000-memory.dmp

Filesize
16.0MB

Download
memory/3392-32-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads