modiloader | 8f15e994b2b4d99413d2beb275356aac8aa7835267b0a62d14b785cf722e1550

General

Target

07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
Size

72KB
MD5

07eb753af2b3573ce7320866c3714140
SHA1

a1351ae7e680f3dc771be34a577cef7feedc7576
SHA256

8f15e994b2b4d99413d2beb275356aac8aa7835267b0a62d14b785cf722e1550
SHA512

95d0b8fb0bc0a079ed35297cb3702b38c3a4c2c2b211deff8663541bf9c13c48c016a33eb3ccb60a96a492e272755d300f139b08a8baf56cac2337ca838ee7f6
SSDEEP

1536:DOa2kZ+qcAGVRIcUjmTeyovQe1RLP0sLJtoz9ZDu7GOXTm:DOYZTBORVUjtvR1L96BSXK

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1384-46-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/1384-52-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/1384-49-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/1384-58-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/1384-59-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe

Executes dropped EXE 3 IoCs

Processes:

Flaseher.exeFlaseher.exeFlaseher.exe

pid process

4800 Flaseher.exe
2284 Flaseher.exe
1384 Flaseher.exe

pid	process
4800	Flaseher.exe
2284	Flaseher.exe
1384	Flaseher.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5024-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3760-6-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3760-8-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3760-13-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/5024-14-0x0000000000400000-0x0000000000422000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe	upx
behavioral2/memory/4800-38-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4800-41-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4800-42-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4800-51-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3760-57-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2284-60-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exeFlaseher.exe

description	pid	process	target process
PID 5024 set thread context of 3760	5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
PID 4800 set thread context of 2284	4800	Flaseher.exe	Flaseher.exe
PID 4800 set thread context of 1384	4800	Flaseher.exe	Flaseher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Flaseher.exe

description	pid	process
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe
Token: SeDebugPrivilege	2284	Flaseher.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exeFlaseher.exeFlaseher.exe

pid	process
5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
3760	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
4800	Flaseher.exe
2284	Flaseher.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe07eb753af2b3573ce7320866c3714140_NeikiAnalytics.execmd.exeFlaseher.exe

description	pid	process	target process
PID 5024 wrote to memory of 3760	5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
PID 5024 wrote to memory of 3760	5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
PID 5024 wrote to memory of 3760	5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
PID 5024 wrote to memory of 3760	5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
PID 5024 wrote to memory of 3760	5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
PID 5024 wrote to memory of 3760	5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
PID 5024 wrote to memory of 3760	5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
PID 5024 wrote to memory of 3760	5024	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
PID 3760 wrote to memory of 5076	3760	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	cmd.exe
PID 3760 wrote to memory of 5076	3760	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	cmd.exe
PID 3760 wrote to memory of 5076	3760	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	cmd.exe
PID 5076 wrote to memory of 3596	5076	cmd.exe	reg.exe
PID 5076 wrote to memory of 3596	5076	cmd.exe	reg.exe
PID 5076 wrote to memory of 3596	5076	cmd.exe	reg.exe
PID 3760 wrote to memory of 4800	3760	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	Flaseher.exe
PID 3760 wrote to memory of 4800	3760	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	Flaseher.exe
PID 3760 wrote to memory of 4800	3760	07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe	Flaseher.exe
PID 4800 wrote to memory of 2284	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 2284	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 2284	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 2284	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 2284	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 2284	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 2284	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 2284	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe
PID 4800 wrote to memory of 1384	4800	Flaseher.exe	Flaseher.exe

C:\Users\Admin\AppData\Local\Temp\07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07eb753af2b3573ce7320866c3714140_NeikiAnalytics.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EJOBN.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f
4⤵
- Adds Run key to start application
PID:3596

C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800

C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2284

C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
4⤵
- Executes dropped EXE
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EJOBN.txt
Filesize
145B

MD5
da0cbe87b720a79b294147ed6a4b98be

SHA1
ebf0dc9efd7a12cb192e355cda87546acb4ab360

SHA256
7ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed

SHA512
f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc

Download Submit
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
Filesize
72KB

MD5
a849f8767281016787a8643ff168a41c

SHA1
21f0d64eeb7aaf65b11091c2ac4cb521ce8422a1

SHA256
54902acf0435d97e16c730aed5e8bd4cc4de57671ddac066ee05b1b2550022e4

SHA512
47eb2dfbd72275ab51f4008868bcddb08e618a4a82b8d53a7dcfcd1d8377a65b402ce6b8a499ff03f3b9d89f689e6d7d7bfecc579c5df0dd76d9f306994575e8

Download Submit
memory/1384-46-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1384-52-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1384-59-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1384-58-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1384-49-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2284-60-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3760-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3760-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3760-13-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3760-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4800-41-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4800-42-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4800-51-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4800-38-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5024-5-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/5024-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5024-4-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/5024-3-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/5024-11-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/5024-12-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/5024-14-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads