modiloader | 3166d24662d79692997f4f945366316d677b0cd6659b3aeeb6894dff2ed4b33a

General

Target

318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
Size

112KB
MD5

318b8e995675dd1844e521e0d841db80
SHA1

d7f40c955c9ab4cab64e16d0a1302ef2a548c897
SHA256

3166d24662d79692997f4f945366316d677b0cd6659b3aeeb6894dff2ed4b33a
SHA512

4745fd91866973f443f8bd1d9a30a7948ac721386c59c26a7dbe3869d3a8ac3cdded83823dad6df6d05aaa722d6307e2436e304c922fe3880dddeb93c4dfb521
SSDEEP

1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/452-283-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral1/memory/452-301-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2200-128-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2200-122-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/452-283-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1740-282-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2200-286-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/452-301-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1740-300-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

Processes:

318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe

description	pid	process	target process
PID 2244 set thread context of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 set thread context of 2200	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe
2548	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exesvchost.exe318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe

pid process

2244 318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
2548 svchost.exe
2200 318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe

pid	process
2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
2548	svchost.exe
2200	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe

description	pid	process	target process
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2548	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2244 wrote to memory of 2200	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2244 wrote to memory of 2200	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2244 wrote to memory of 2200	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2244 wrote to memory of 2200	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2244 wrote to memory of 2200	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2244 wrote to memory of 2200	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2244 wrote to memory of 2200	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2244 wrote to memory of 2200	2244	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2548

C:\Users\Admin\AppData\Local\Temp\318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\KAVSR.bat" "
3⤵
PID:2812

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
4⤵
PID:2840

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
3⤵
PID:1860

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
4⤵
PID:1644

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
4⤵
PID:1740

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
4⤵
PID:452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KAVSR.bat
Filesize
148B

MD5
3a4614705555abb049c3298e61170b7f

SHA1
c8686410756f346d9551256a5b878b04770950ba

SHA256
cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

SHA512
65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
Filesize
112KB

MD5
c2ef5073ac73965d1d727f74c4cf4928

SHA1
b5070423a2019ee70b40bbb5e1faaf873659f053

SHA256
86b1d007b11ecc5a7d3beb818f8e5fd3c5720434eb425dc76315b48ce3141415

SHA512
d02e382d73456f18cdbaa3cdd0379e2a7b749e98932a2c57002c6c66e6f4f0cb7f1686add48188a80018cf2dae88d4b1d2e069c36b507cc49d83164e575d5f72

Download Submit
memory/452-301-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/452-283-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1740-300-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1740-282-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2200-128-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2200-286-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2200-122-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2244-20-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2244-28-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2244-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2244-8-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2244-14-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2244-38-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/2244-32-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2244-87-0x00000000004A0000-0x00000000004A2000-memory.dmp

Filesize
8KB

Download
memory/2244-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2244-79-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2244-74-0x0000000000460000-0x0000000000462000-memory.dmp

Filesize
8KB

Download
memory/2548-125-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-88-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-90-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-92-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-94-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-96-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-299-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-98-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2548-100-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads