modiloader | d3717abefae0bcbd098e554bf6a626d452c40aabef45145161490f0fd56b978b

General

Target

ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
Size

308KB
MD5

ae1ec6c32857e18f9a5399e891a9cb90
SHA1

cfbb316bf21a56221c4a5fdf7e2c319f5fa38046
SHA256

d3717abefae0bcbd098e554bf6a626d452c40aabef45145161490f0fd56b978b
SHA512

ee0fdf9fb085d3893ca6295bb37dc73fbf0464fddde9a807b29d6a2461a0c3516e39f718a72a8842f24ce7de64ecbb1d7dcb776d9def7861294089ddb3a79f16
SSDEEP

3072:/c3sBG7mXh7m/zZM3jAbNOM6CNtDCZFL:E3sBz0Z4Mj72F

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2120-49-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/2120-48-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/2120-52-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/2120-56-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe

Executes dropped EXE 3 IoCs

Processes:

csrsll.execsrsll.execsrsll.exe

pid process

3488 csrsll.exe
4944 csrsll.exe
2120 csrsll.exe

pid	process
3488	csrsll.exe
4944	csrsll.exe
2120	csrsll.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/468-4-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/468-8-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/468-10-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2120-49-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2120-48-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2120-52-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2120-46-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2120-41-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/468-53-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4944-55-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2120-56-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.execsrsll.exe

description	pid	process	target process
PID 1704 set thread context of 468	1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
PID 3488 set thread context of 4944	3488	csrsll.exe	csrsll.exe
PID 3488 set thread context of 2120	3488	csrsll.exe	csrsll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

csrsll.exe

description	pid	process
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe
Token: SeDebugPrivilege	4944	csrsll.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exeae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.execsrsll.execsrsll.exe

pid process

1704 ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
468 ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
3488 csrsll.exe
4944 csrsll.exe

pid	process
1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
468	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
3488	csrsll.exe
4944	csrsll.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exeae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.execmd.execsrsll.exe

description	pid	process	target process
PID 1704 wrote to memory of 468	1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
PID 1704 wrote to memory of 468	1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
PID 1704 wrote to memory of 468	1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
PID 1704 wrote to memory of 468	1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
PID 1704 wrote to memory of 468	1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
PID 1704 wrote to memory of 468	1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
PID 1704 wrote to memory of 468	1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
PID 1704 wrote to memory of 468	1704	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
PID 468 wrote to memory of 4184	468	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	cmd.exe
PID 468 wrote to memory of 4184	468	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	cmd.exe
PID 468 wrote to memory of 4184	468	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	cmd.exe
PID 4184 wrote to memory of 4064	4184	cmd.exe	reg.exe
PID 4184 wrote to memory of 4064	4184	cmd.exe	reg.exe
PID 4184 wrote to memory of 4064	4184	cmd.exe	reg.exe
PID 468 wrote to memory of 3488	468	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	csrsll.exe
PID 468 wrote to memory of 3488	468	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	csrsll.exe
PID 468 wrote to memory of 3488	468	ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe	csrsll.exe
PID 3488 wrote to memory of 4944	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 4944	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 4944	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 4944	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 4944	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 4944	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 4944	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 4944	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 2120	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 2120	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 2120	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 2120	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 2120	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 2120	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 2120	3488	csrsll.exe	csrsll.exe
PID 3488 wrote to memory of 2120	3488	csrsll.exe	csrsll.exe

C:\Users\Admin\AppData\Local\Temp\ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\ae1ec6c32857e18f9a5399e891a9cb90_NeikiAnalytics.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XUTXK.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f
      4⤵
      Adds Run key to start application
      PID:4064
- - C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4944
  - - C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
      4⤵
      Executes dropped EXE
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XUTXK.txt

Filesize
145B

MD5
4eb61ec7816c34ec8c125acadc57ec1b

SHA1
b0015cc865c0bb1a027be663027d3829401a31cc

SHA256
08375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff

SHA512
f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe

Filesize
308KB

MD5
c5475262dc935994255259d6b25c83e0

SHA1
faa9fcea9ac4625e40bf542749181fdf9aa756f1

SHA256
fab5f7a7d124b025b8d363e6c102cadd163021159574579b7bac66b6da22c489

SHA512
aa4327d8f6ae86a6956364741a2bf9acc1fc5a6884c5cbb5597cb92d8bd63a85a51bf5c976de9b89d5a2d3d8426ea972ad5bc32aade7ed883e44c1fa75290043

Download Submit
memory/468-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/468-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/468-10-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/468-53-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1704-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1704-3-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/1704-5-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/1704-6-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/2120-46-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2120-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2120-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2120-52-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2120-41-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2120-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3488-47-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3488-37-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3488-34-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4944-55-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads