modiloader | 654f4302585126e759fd3c05944a56b69276d159f413ff2f17cec4bb2ad6ed42

General

Target

b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
Size

308KB
MD5

b08a503b2ef84eb6a8fd48d56fadd6f0
SHA1

25144a87f414ca13d30f28042328b6ee5bdc94c6
SHA256

654f4302585126e759fd3c05944a56b69276d159f413ff2f17cec4bb2ad6ed42
SHA512

38650f2802e44c63afea7e0e62ec435da27f267da8a60399377d3dd33930c32c883fc6eda4c7b5ac6afa222ebdd07c4f018e6831c2daf8ead34d5420d0a6e45a
SSDEEP

3072:/c3sBG7mXh7m/zZM3jAbNOM6CNtDCZFL:E3sBz0Z4Mj72F

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2168-52-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/2168-51-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/2168-49-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/2168-56-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe

Executes dropped EXE 3 IoCs

Processes:

csrsll.execsrsll.execsrsll.exe

pid process

2224 csrsll.exe
3172 csrsll.exe
2168 csrsll.exe

pid	process
2224	csrsll.exe
3172	csrsll.exe
2168	csrsll.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3216-9-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3216-10-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3216-4-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3216-53-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2168-52-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2168-51-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2168-49-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2168-46-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2168-41-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3172-55-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2168-56-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.execsrsll.exe

description	pid	process	target process
PID 2796 set thread context of 3216	2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
PID 2224 set thread context of 3172	2224	csrsll.exe	csrsll.exe
PID 2224 set thread context of 2168	2224	csrsll.exe	csrsll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

csrsll.exe

description	pid	process
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe
Token: SeDebugPrivilege	3172	csrsll.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exeb08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.execsrsll.execsrsll.exe

pid process

2796 b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
3216 b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
2224 csrsll.exe
3172 csrsll.exe

pid	process
2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
3216	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
2224	csrsll.exe
3172	csrsll.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exeb08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.execmd.execsrsll.exe

description	pid	process	target process
PID 2796 wrote to memory of 3216	2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
PID 2796 wrote to memory of 3216	2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
PID 2796 wrote to memory of 3216	2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
PID 2796 wrote to memory of 3216	2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
PID 2796 wrote to memory of 3216	2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
PID 2796 wrote to memory of 3216	2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
PID 2796 wrote to memory of 3216	2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
PID 2796 wrote to memory of 3216	2796	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
PID 3216 wrote to memory of 1860	3216	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	cmd.exe
PID 3216 wrote to memory of 1860	3216	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	cmd.exe
PID 3216 wrote to memory of 1860	3216	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	cmd.exe
PID 1860 wrote to memory of 3836	1860	cmd.exe	reg.exe
PID 1860 wrote to memory of 3836	1860	cmd.exe	reg.exe
PID 1860 wrote to memory of 3836	1860	cmd.exe	reg.exe
PID 3216 wrote to memory of 2224	3216	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	csrsll.exe
PID 3216 wrote to memory of 2224	3216	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	csrsll.exe
PID 3216 wrote to memory of 2224	3216	b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe	csrsll.exe
PID 2224 wrote to memory of 3172	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 3172	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 3172	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 3172	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 3172	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 3172	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 3172	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 3172	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 2168	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 2168	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 2168	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 2168	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 2168	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 2168	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 2168	2224	csrsll.exe	csrsll.exe
PID 2224 wrote to memory of 2168	2224	csrsll.exe	csrsll.exe

C:\Users\Admin\AppData\Local\Temp\b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796

C:\Users\Admin\AppData\Local\Temp\b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b08a503b2ef84eb6a8fd48d56fadd6f0_NeikiAnalytics.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NBEPQ.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f
4⤵
- Adds Run key to start application
PID:3836

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3172

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
4⤵
- Executes dropped EXE
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NBEPQ.txt
Filesize
145B

MD5
4eb61ec7816c34ec8c125acadc57ec1b

SHA1
b0015cc865c0bb1a027be663027d3829401a31cc

SHA256
08375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff

SHA512
f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
Filesize
308KB

MD5
60a4b073b50b09d98c96a6e259dad1a5

SHA1
5c18a9ff4dd83d1d6484d63b26842288a91d01f3

SHA256
3442ffcb5050d567aff0974cd544a8b0294fc5d494c988e050683aecb9b02938

SHA512
d8c3f92679705e861bc4cafee56a0d5d14c17717dc6da983c1ca0b160cfa89b0a7b3652a3c211f774492bbfc1a1e5895660d5b224e29ae04ab8eeee21dc8d755

Download Submit
memory/2168-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2168-41-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2168-46-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2168-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2168-51-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2168-52-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2224-47-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2224-34-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2224-37-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2796-8-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/2796-7-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/2796-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2796-3-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/3172-55-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3216-53-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3216-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3216-10-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3216-9-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads